[PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Lorenzo Pieralisi]

Running the Clang static analyzer on IORT code detected the following
error:

Logic error: Branch condition evaluates to a garbage value

in

iort_get_platform_device_domain()

If the named component associated with a given device has no IORT
mappings, iort_get_platform_device_domain() exits its MSI mapping loop
with msi_parent pointer containing garbage, which can lead to erroneous
code path execution.

Initialize the msi_parent pointer, fixing the bug.

Fixes: d4f54a186667 ("ACPI: platform: setup MSI domain for ACPI based
platform device")
Reported-by: Patrick Bellasi <patrick.bellasi@arm.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Hanjun Guo <hanjun.guo@linaro.org>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
---
 drivers/acpi/arm64/iort.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 2a361e22d38d..70f4e80b9246 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
  */
 static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
 {
-	struct acpi_iort_node *node, *msi_parent;
+	struct acpi_iort_node *node, *msi_parent = NULL;
 	struct fwnode_handle *iort_fwnode;
 	struct acpi_iort_its_group *its;
 	int i;
-- 
2.19.2

[PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Lorenzo Pieralisi]

Running the Clang static analyzer on IORT code detected the following
error:

Logic error: Branch condition evaluates to a garbage value

in

iort_get_platform_device_domain()

If the named component associated with a given device has no IORT
mappings, iort_get_platform_device_domain() exits its MSI mapping loop
with msi_parent pointer containing garbage, which can lead to erroneous
code path execution.

Initialize the msi_parent pointer, fixing the bug.

Fixes: d4f54a186667 ("ACPI: platform: setup MSI domain for ACPI based
platform device")
Reported-by: Patrick Bellasi <patrick.bellasi@arm.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Hanjun Guo <hanjun.guo@linaro.org>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
---
 drivers/acpi/arm64/iort.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index 2a361e22d38d..70f4e80b9246 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
  */
 static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
 {
-	struct acpi_iort_node *node, *msi_parent;
+	struct acpi_iort_node *node, *msi_parent = NULL;
 	struct fwnode_handle *iort_fwnode;
 	struct acpi_iort_its_group *its;
 	int i;
-- 
2.19.2

Re: [PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Hanjun Guo]

On 2018/11/29 17:55, Lorenzo Pieralisi wrote:
> Running the Clang static analyzer on IORT code detected the following
> error:
> 
> Logic error: Branch condition evaluates to a garbage value
> 
> in
> 
> iort_get_platform_device_domain()
> 
> If the named component associated with a given device has no IORT
> mappings, iort_get_platform_device_domain() exits its MSI mapping loop
> with msi_parent pointer containing garbage, which can lead to erroneous
> code path execution.

Not sure if we have such use cases that named component associated with
a given device has no IORT mappings, but this patch still make sense to
me,

Reviewed-by: Hanjun Guo <hanjun.guo@linaro.org>

Thanks
Hanjun

Re: [PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Lorenzo Pieralisi]

On Thu, Nov 29, 2018 at 07:34:40PM +0800, Hanjun Guo wrote:
> On 2018/11/29 17:55, Lorenzo Pieralisi wrote:
> > Running the Clang static analyzer on IORT code detected the following
> > error:
> > 
> > Logic error: Branch condition evaluates to a garbage value
> > 
> > in
> > 
> > iort_get_platform_device_domain()
> > 
> > If the named component associated with a given device has no IORT
> > mappings, iort_get_platform_device_domain() exits its MSI mapping loop
> > with msi_parent pointer containing garbage, which can lead to erroneous
> > code path execution.
> 
> Not sure if we have such use cases that named component associated with
> a given device has no IORT mappings, but this patch still make sense to
> me,

Yes, it is to make the kernel more robust against questionable (but valid)
firmware bindings.

Thanks,
Lorenzo

Re: [PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Lorenzo Pieralisi]

On Thu, Nov 29, 2018 at 07:34:40PM +0800, Hanjun Guo wrote:
> On 2018/11/29 17:55, Lorenzo Pieralisi wrote:
> > Running the Clang static analyzer on IORT code detected the following
> > error:
> > 
> > Logic error: Branch condition evaluates to a garbage value
> > 
> > in
> > 
> > iort_get_platform_device_domain()
> > 
> > If the named component associated with a given device has no IORT
> > mappings, iort_get_platform_device_domain() exits its MSI mapping loop
> > with msi_parent pointer containing garbage, which can lead to erroneous
> > code path execution.
> 
> Not sure if we have such use cases that named component associated with
> a given device has no IORT mappings, but this patch still make sense to
> me,

Yes, it is to make the kernel more robust against questionable (but valid)
firmware bindings.

Thanks,
Lorenzo

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Will Deacon]

On Thu, Nov 29, 2018 at 09:55:59AM +0000, Lorenzo Pieralisi wrote:
> Running the Clang static analyzer on IORT code detected the following
> error:
> 
> Logic error: Branch condition evaluates to a garbage value
> 
> in
> 
> iort_get_platform_device_domain()
> 
> If the named component associated with a given device has no IORT
> mappings, iort_get_platform_device_domain() exits its MSI mapping loop
> with msi_parent pointer containing garbage, which can lead to erroneous
> code path execution.
> 
> Initialize the msi_parent pointer, fixing the bug.
> 
> Fixes: d4f54a186667 ("ACPI: platform: setup MSI domain for ACPI based
> platform device")
> Reported-by: Patrick Bellasi <patrick.bellasi@arm.com>
> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> Cc: Will Deacon <will.deacon@arm.com>
> Cc: Hanjun Guo <hanjun.guo@linaro.org>
> Cc: Sudeep Holla <sudeep.holla@arm.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
> ---
>  drivers/acpi/arm64/iort.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Acked-by: Will Deacon <will.deacon@arm.com>

Looks like one for 4.20.

Will

> diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
> index 2a361e22d38d..70f4e80b9246 100644
> --- a/drivers/acpi/arm64/iort.c
> +++ b/drivers/acpi/arm64/iort.c
> @@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
>   */
>  static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
>  {
> -	struct acpi_iort_node *node, *msi_parent;
> +	struct acpi_iort_node *node, *msi_parent = NULL;
>  	struct fwnode_handle *iort_fwnode;
>  	struct acpi_iort_its_group *its;
>  	int i;
> -- 
> 2.19.2
> 

Re: [PATCH] ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value

[Will Deacon]

On Thu, Nov 29, 2018 at 09:55:59AM +0000, Lorenzo Pieralisi wrote:
> Running the Clang static analyzer on IORT code detected the following
> error:
> 
> Logic error: Branch condition evaluates to a garbage value
> 
> in
> 
> iort_get_platform_device_domain()
> 
> If the named component associated with a given device has no IORT
> mappings, iort_get_platform_device_domain() exits its MSI mapping loop
> with msi_parent pointer containing garbage, which can lead to erroneous
> code path execution.
> 
> Initialize the msi_parent pointer, fixing the bug.
> 
> Fixes: d4f54a186667 ("ACPI: platform: setup MSI domain for ACPI based
> platform device")
> Reported-by: Patrick Bellasi <patrick.bellasi@arm.com>
> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> Cc: Will Deacon <will.deacon@arm.com>
> Cc: Hanjun Guo <hanjun.guo@linaro.org>
> Cc: Sudeep Holla <sudeep.holla@arm.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
> ---
>  drivers/acpi/arm64/iort.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Acked-by: Will Deacon <will.deacon@arm.com>

Looks like one for 4.20.

Will

> diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
> index 2a361e22d38d..70f4e80b9246 100644
> --- a/drivers/acpi/arm64/iort.c
> +++ b/drivers/acpi/arm64/iort.c
> @@ -700,7 +700,7 @@ static void iort_set_device_domain(struct device *dev,
>   */
>  static struct irq_domain *iort_get_platform_device_domain(struct device *dev)
>  {
> -	struct acpi_iort_node *node, *msi_parent;
> +	struct acpi_iort_node *node, *msi_parent = NULL;
>  	struct fwnode_handle *iort_fwnode;
>  	struct acpi_iort_its_group *its;
>  	int i;
> -- 
> 2.19.2
> 

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel