netdev - Re: [PATCH v2 net] net: wwan: iosm: fix NULL pointer dereference when removing device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZGIdj7GBwZBVLR+x@corigine.com>
Date: Mon, 15 May 2023 13:54:55 +0200
From: Simon Horman <simon.horman@...igine.com>
To: m.chetan.kumar@...ux.intel.com
Cc: netdev@...r.kernel.org, kuba@...nel.org, davem@...emloft.net,
	johannes@...solutions.net, ryazanov.s.a@...il.com,
	loic.poulain@...aro.org, linuxwwan@...el.com,
	m.chetan.kumar@...el.com, edumazet@...gle.com, pabeni@...hat.com,
	Samuel Wein PhD <sam@...wein.com>
Subject: Re: [PATCH v2 net] net: wwan: iosm: fix NULL pointer dereference
 when removing device

On Mon, May 15, 2023 at 01:01:25PM +0530, m.chetan.kumar@...ux.intel.com wrote:
> From: M Chetan Kumar <m.chetan.kumar@...ux.intel.com>
> 
> In suspend and resume cycle, the removal and rescan of device ends
> up in NULL pointer dereference.
> 
> During driver initialization, if the ipc_imem_wwan_channel_init()
> fails to get the valid device capabilities it returns an error and
> further no resource (wwan struct) will be allocated. Now in this
> situation if driver removal procedure is initiated it would result
> in NULL pointer exception since unallocated wwan struct is dereferenced
> inside ipc_wwan_deinit().
> 
> ipc_imem_run_state_worker() to handle the called functions return value
> and to release the resource in failure case. It also reports the link
> down event in failure cases. The user space application can handle this
> event to do a device reset for restoring the device communication.
> 
> Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface")
> Reported-by: Samuel Wein PhD <sam@...wein.com>
> Closes: https://lore.kernel.org/netdev/20230427140819.1310f4bd@kernel.org/T/
> Signed-off-by: M Chetan Kumar <m.chetan.kumar@...ux.intel.com>
> --
> v1 -> v2:
> * Fix review comments given by Simon Horman.
> - goto labes renamed to reflect after usage instead where they are
> called from.
> - ipc_mux_deinit() checks for initalization state so is safe to keep
> under common err_out.
> ---
>  drivers/net/wwan/iosm/iosm_ipc_imem.c     | 26 +++++++++++++++++------
>  drivers/net/wwan/iosm/iosm_ipc_imem_ops.c | 12 +++++++----
>  drivers/net/wwan/iosm/iosm_ipc_imem_ops.h |  6 ++++--
>  3 files changed, 32 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/net/wwan/iosm/iosm_ipc_imem.c b/drivers/net/wwan/iosm/iosm_ipc_imem.c
> index c066b0040a3f..4520fd148601 100644
> --- a/drivers/net/wwan/iosm/iosm_ipc_imem.c
> +++ b/drivers/net/wwan/iosm/iosm_ipc_imem.c
> @@ -565,24 +565,32 @@ static void ipc_imem_run_state_worker(struct work_struct *instance)
>  	struct ipc_mux_config mux_cfg;
>  	struct iosm_imem *ipc_imem;
>  	u8 ctrl_chl_idx = 0;
> +	int ret;
>  
>  	ipc_imem = container_of(instance, struct iosm_imem, run_state_worker);
>  
>  	if (ipc_imem->phase != IPC_P_RUN) {
>  		dev_err(ipc_imem->dev,
>  			"Modem link down. Exit run state worker.");
> -		return;
> +		goto err_out;

Sorry, some of my previous advice may have lead to some problems.

	Is ipc_imem->mux uninitialised here

>  	}
>  
>  	if (test_and_clear_bit(IOSM_DEVLINK_INIT, &ipc_imem->flag))
>  		ipc_devlink_deinit(ipc_imem->ipc_devlink);
>  
> -	if (!ipc_imem_setup_cp_mux_cap_init(ipc_imem, &mux_cfg))
> -		ipc_imem->mux = ipc_mux_init(&mux_cfg, ipc_imem);
> +	ret = ipc_imem_setup_cp_mux_cap_init(ipc_imem, &mux_cfg);
> +	if (ret < 0)
> +		goto err_out;

	and here?

> +
> +	ipc_imem->mux = ipc_mux_init(&mux_cfg, ipc_imem);
> +	if (!ipc_imem->mux)
> +		goto err_out;

	ipc_imem->mux is NULL here.
> +
> +	ret = ipc_imem_wwan_channel_init(ipc_imem, mux_cfg.protocol);
> +	if (ret < 0)
> +		goto err_out;
>  
> -	ipc_imem_wwan_channel_init(ipc_imem, mux_cfg.protocol);
> -	if (ipc_imem->mux)
> -		ipc_imem->mux->wwan = ipc_imem->wwan;
> +	ipc_imem->mux->wwan = ipc_imem->wwan;
>  
>  	while (ctrl_chl_idx < IPC_MEM_MAX_CHANNELS) {
>  		if (!ipc_chnl_cfg_get(&chnl_cfg_port, ctrl_chl_idx)) {
> @@ -622,6 +630,12 @@ static void ipc_imem_run_state_worker(struct work_struct *instance)
>  
>  	/* Complete all memory stores after setting bit */
>  	smp_mb__after_atomic();
> +
> +	return;
> +
> +err_out:
> +	ipc_mux_deinit(ipc_imem->mux);

	But ipc_mux_deinit always dereferences it's argument.

> +	ipc_uevent_send(ipc_imem->dev, UEVENT_CD_READY_LINK_DOWN);
>  }

Perhaps, contrary to some of my earlier advice,
it's better to have two labels.

Say,

err_ipc_mux_deinit:
	ipc_mux_deinit(ipc_imem->mux);
err_out:
	ipc_uevent_send(ipc_imem->dev, UEVENT_CD_READY_LINK_DOWN);

...