Date: Wed, 20 Mar 2024 12:38:43 +0000
From: Claus Hansen Ries <chr@...ma.com>
To: Simon Horman <horms@...nel.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "David S. Miller"
	<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski
	<kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Michal Simek
	<michal.simek@....com>, Alex Elder <elder@...aro.org>, Wei Fang
	<wei.fang@....com>, Uwe Kleine-König
	<u.kleine-koenig@...gutronix.de>, Dan Carpenter <dan.carpenter@...aro.org>,
	Rob Herring <robh@...nel.org>, Wang Hai <wanghai38@...wei.com>
Subject: RE: [PATCH] net: ll_temac: platform_get_resource replaced by wrong
 function

Hi,

We ran into the issue when upgrading from kernel 5.4.x to 6.1.x. I don't think it is a much used driver.

Can't say if this would work on different implementations of Xilinx HDL, but looking at the code, I can't see devm_platform_ioremap_resource_byname/platform_get_resource_byname succeed without hitting strcmp, any other path makes the platform_get_resource_byname return NULL and __devm_ioremap_resource fail with "res == NULL" (as far I can see). It would require strcmp being able to survive with the name pointer being equal to 0.

void __iomem *
devm_platform_ioremap_resource_byname(struct platform_device *pdev,
				      const char *name)
{
	struct resource *res;

	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
	return devm_ioremap_resource(&pdev->dev, res);
}



struct resource *platform_get_resource_byname(struct platform_device *dev,
					      unsigned int type,
					      const char *name)
{
	u32 i;

	for (i = 0; i < dev->num_resources; i++) {
		struct resource *r = &dev->resource[i];

		if (unlikely(!r->name))
			continue;

		if (type == resource_type(r) && !strcmp(r->name, name))
			return r;
	}
	return NULL;
}

void __iomem *devm_ioremap_resource(struct device *dev,
				    const struct resource *res)
{
	return __devm_ioremap_resource(dev, res, DEVM_IOREMAP);
}

__devm_ioremap_resource(struct device *dev, const struct resource *res,
			enum devm_ioremap_type type)
{
	resource_size_t size;
	void __iomem *dest_ptr;
	char *pretty_name;

	BUG_ON(!dev);

	if (!res || resource_type(res) != IORESOURCE_MEM) {
		dev_err(dev, "invalid resource %pR\n", res);
		return IOMEM_ERR_PTR(-EINVAL);
	}
....

Claus Hansen Ries
Specialist, Software Engineering
Radar Application Software
Terma A/S

-----Original Message-----
From: Simon Horman <horms@...nel.org> 
Sent: 20. marts 2024 12:55
To: Claus Hansen Ries <chr@...ma.com>
Cc: netdev@...r.kernel.org; David S. Miller <davem@...emloft.net>; Eric Dumazet <edumazet@...gle.com>; Jakub Kicinski <kuba@...nel.org>; Paolo Abeni <pabeni@...hat.com>; Michal Simek <michal.simek@....com>; Alex Elder <elder@...aro.org>; Wei Fang <wei.fang@....com>; Uwe Kleine-König <u.kleine-koenig@...gutronix.de>; Dan Carpenter <dan.carpenter@...aro.org>; Rob Herring <robh@...nel.org>; Wang Hai <wanghai38@...wei.com>
Subject: Re: [PATCH] net: ll_temac: platform_get_resource replaced by wrong function

CAUTION: This email originated from outside of Terma. Do not click links or open attachments unless you recognize the sender and know the content is safe.

+ Eric Dumazet, Jakub Kicinski, Paolo Abeni, Michal Simek, Alex Elder
  Wei Fang, Uwe Kleine-König, Dan Carpenter, Rob Herring, Wang Hai

On Tue, Mar 19, 2024 at 07:45:26PM +0000, Claus Hansen Ries wrote:
> From: Claus Hansen ries <chr@...ma.com>
>
> devm_platform_ioremap_resource_byname is called using 0 as name, which 
> eventually ends up in platform_get_resource_byname, where it causes a null pointer in strcmp.
>
>                 if (type == resource_type(r) && !strcmp(r->name, 
> name))
>
> The correct function is devm_platform_ioremap_resource.

Hi Claus,

It is curious that this wasn't noticed earlier - does the driver function in some circumstances without this change?

>
> Fixes: bd69058 ("net: ll_temac: Use 
> devm_platform_ioremap_resource_byname()")

nit: Fixes tags should use 12 or more characters for the hash.

Fixes: bd69058f50d5 ("net: ll_temac: Use devm_platform_ioremap_resource_byname()")

> Signed-off-by: Claus H. Ries <chr@...ma.com>
> Cc: stable@...r.kernel.org

Unfortunately the patch does not apply - it seems that tabs have been replaced by spaces somewhere along the way. It would be best to repost with that addressed. Using git send-email usually works.

Also, as this is a fix, please target it at the net tree.
That means it should be based on that tree (that part is fine :) and designated as being for net in the subject.

        Subject: [PATCH net] ...

Lastly, please run get_maintainer.pl on your patch to provide the list of parties to CC.

https://docs.kernel.org/process/maintainer-netdev.html

> ---
>  drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c 
> b/drivers/net/ethernet/xilinx/ll_temac_main.c
> index 9df39cf8b097..1072e2210aed 100644
> --- a/drivers/net/ethernet/xilinx/ll_temac_main.c
> +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
> @@ -1443,7 +1443,7 @@ static int temac_probe(struct platform_device *pdev)
>         }
>           /* map device registers */
> -       lp->regs = devm_platform_ioremap_resource_byname(pdev, 0);
> +       lp->regs = devm_platform_ioremap_resource(pdev, 0);
>         if (IS_ERR(lp->regs)) {
>                 dev_err(&pdev->dev, "could not map TEMAC registers\n");
>                 return -ENOMEM;
>
> base-commit: d95fcdf4961d27a3d17e5c7728367197adc89b8d
> --  2.39.3 (Apple Git-146)
>
>
>

--
pw-bot: changes-requested

Powered by blists - more mailing lists