linux-kernel - Re: [PATCH v7 01/16] pinctrl: check the return value of pinmux_ops::get_function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMRc=Mdp2djgGbgu_uwLSkrtRPomAU=6-SRdzCdSbrHWzS2c2A@mail.gmail.com>
Date: Tue, 2 Sep 2025 16:02:27 +0200
From: Bartosz Golaszewski <brgl@...ev.pl>
To: Andy Shevchenko <andriy.shevchenko@...el.com>
Cc: Linus Walleij <linus.walleij@...aro.org>, Bjorn Andersson <andersson@...nel.org>, 
	Konrad Dybcio <konradybcio@...nel.org>, Alexey Klimov <alexey.klimov@...aro.org>, 
	Lorenzo Bianconi <lorenzo@...nel.org>, Sean Wang <sean.wang@...nel.org>, 
	Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, 
	Paul Cercueil <paul@...pouillou.net>, Kees Cook <kees@...nel.org>, 
	Andy Shevchenko <andy@...nel.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	David Hildenbrand <david@...hat.com>, Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, 
	"Liam R. Howlett" <Liam.Howlett@...cle.com>, Vlastimil Babka <vbabka@...e.cz>, 
	Mike Rapoport <rppt@...nel.org>, Suren Baghdasaryan <surenb@...gle.com>, Michal Hocko <mhocko@...e.com>, 
	Dong Aisheng <aisheng.dong@....com>, Fabio Estevam <festevam@...il.com>, 
	Shawn Guo <shawnguo@...nel.org>, Jacky Bai <ping.bai@....com>, 
	Pengutronix Kernel Team <kernel@...gutronix.de>, NXP S32 Linux Team <s32@....com>, 
	Sascha Hauer <s.hauer@...gutronix.de>, Tony Lindgren <tony@...mide.com>, 
	Haojian Zhuang <haojian.zhuang@...aro.org>, Geert Uytterhoeven <geert+renesas@...der.be>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "Rafael J. Wysocki" <rafael@...nel.org>, 
	Danilo Krummrich <dakr@...nel.org>, Neil Armstrong <neil.armstrong@...aro.org>, 
	Mark Brown <broonie@...nel.org>, linux-gpio@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org, 
	linux-mediatek@...ts.infradead.org, linux-arm-kernel@...ts.infradead.org, 
	linux-mips@...r.kernel.org, linux-hardening@...r.kernel.org, 
	linux-mm@...ck.org, imx@...ts.linux.dev, linux-omap@...r.kernel.org, 
	linux-renesas-soc@...r.kernel.org, 
	Bartosz Golaszewski <bartosz.golaszewski@...aro.org>, stable@...r.kernel.org
Subject: Re: [PATCH v7 01/16] pinctrl: check the return value of pinmux_ops::get_function_name()

On Tue, Sep 2, 2025 at 3:50 PM Andy Shevchenko
<andriy.shevchenko@...el.com> wrote:
>
> On Tue, Sep 02, 2025 at 03:29:31PM +0200, Bartosz Golaszewski wrote:
> > On Tue, Sep 2, 2025 at 3:06 PM Andy Shevchenko
> > <andriy.shevchenko@...el.com> wrote:
> > > On Tue, Sep 02, 2025 at 01:59:10PM +0200, Bartosz Golaszewski wrote:
> > > >
> > > > While the API contract in docs doesn't specify it explicitly,
> > >
> > > So, why not to amend the doc at the same time?
> >
> > Because this series is already big as is. That would be another commit
> > that can be separate.
>
> I meant _in the same_ patch.
>
> > > > the generic implementation of the get_function_name() callback from struct
> > > > pinmux_ops - pinmux_generic_get_function_name() - can fail and return
> > > > NULL. This is already checked in pinmux_check_ops() so add a similar
> > > > check in pinmux_func_name_to_selector() instead of passing the returned
> > > > pointer right down to strcmp() where the NULL can get dereferenced. This
> > > > is normal operation when adding new pinfunctions.
>
> > > Fixes?
> >
> > This has always been like that.
> >
> > > Reported?
> >
> > I mean, technically Mark Brown reported my previous patch failing but
> > I don't think we do this if we're still within the same series just
> > another iteration?
> >
> > > Closes?
> >
> > Ditto.
>
> I meant that this fixes a potential issue disregard to your series, right?
>

No, as long as the imx driver keeps putting stuff into the pin
function radix tree directly, this cannot happen. The issue was
triggered by the discrepancy between the number of added selectors and
the hardcoded number of functions (we started at 0 which was not in
the radix tree and crashed before we got to 1).

Bart