[PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[Wei Yongjun]

From: Wei Yongjun <weiyongjun1@huawei.com>

KASAN report null-ptr-deref as follows:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
Call Trace:
 <TASK>
 ltc2496_probe+0xf4/0x150
 spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
 call_driver_probe drivers/base/dd.c:560 [inline]
 really_probe+0x207/0x750 drivers/base/dd.c:639
 __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
 device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105

This happend when probe ltc2496 device with spi device id but without
dts, device_get_match_data() return null chip_info. Fix it by adding
null check for chip_info in ltc2496_probe().

Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>

diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c
index 2593fa4322eb..a7353c3dd006 100644
--- a/drivers/iio/adc/ltc2496.c
+++ b/drivers/iio/adc/ltc2496.c
@@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi)
 	st->spi = spi;
 	st->common_ddata.result_and_measure = ltc2496_result_and_measure;
 	st->common_ddata.chip_info = device_get_match_data(dev);
+	if (!st->common_ddata.chip_info)
+		return -ENODEV;
 
 	return ltc2497core_probe(dev, indio_dev);
 }
-- 
2.34.1

RE: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[Sa, Nuno]

> -----Original Message-----
> From: Wei Yongjun <weiyongjun@huaweicloud.com>
> Sent: Wednesday, September 28, 2022 6:10 AM
> To: Lars-Peter Clausen <lars@metafoo.de>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> Regus, Ciprian <Ciprian.Regus@analog.com>
> Cc: Wei Yongjun <weiyongjun1@huawei.com>; linux-iio@vger.kernel.org
> Subject: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in
> ltc2496_probe()
> 
> [External]
> 
> From: Wei Yongjun <weiyongjun1@huawei.com>
> 
> KASAN report null-ptr-deref as follows:
> 
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1
> 04/01/2014
> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
> Call Trace:
>  <TASK>
>  ltc2496_probe+0xf4/0x150
>  spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
>  call_driver_probe drivers/base/dd.c:560 [inline]
>  really_probe+0x207/0x750 drivers/base/dd.c:639
>  __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
>  device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
> 
> This happend when probe ltc2496 device with spi device id but without
> dts, device_get_match_data() return null chip_info. Fix it by adding
> null check for chip_info in ltc2496_probe().
> 
> Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio
> device")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
> 

Thanks!

Reviewed-by: Nuno Sá <nuno.sa@analog.com>

Re: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[Jonathan Cameron]

On Wed, 28 Sep 2022 04:09:48 +0000
Wei Yongjun <weiyongjun@huaweicloud.com> wrote:

> From: Wei Yongjun <weiyongjun1@huawei.com>
> 
> KASAN report null-ptr-deref as follows:
> 
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
> Call Trace:
>  <TASK>
>  ltc2496_probe+0xf4/0x150
>  spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
>  call_driver_probe drivers/base/dd.c:560 [inline]
>  really_probe+0x207/0x750 drivers/base/dd.c:639
>  __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
>  device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
> 
> This happend when probe ltc2496 device with spi device id but without
> dts, device_get_match_data() return null chip_info. Fix it by adding
> null check for chip_info in ltc2496_probe().

What tree are you based on?  When I look at this file I'm not seeing a
spi_device_id table so how is it matching?

Also I'd prefer a more comprehensive fix that ensured the same data is
available via the spi_device_id table and uses that if
device_get_match_data() == NULL.

Jonathan

> 
> Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
> 
> diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c
> index 2593fa4322eb..a7353c3dd006 100644
> --- a/drivers/iio/adc/ltc2496.c
> +++ b/drivers/iio/adc/ltc2496.c
> @@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi)
>  	st->spi = spi;
>  	st->common_ddata.result_and_measure = ltc2496_result_and_measure;
>  	st->common_ddata.chip_info = device_get_match_data(dev);
> +	if (!st->common_ddata.chip_info)
> +		return -ENODEV;
>  
>  	return ltc2497core_probe(dev, indio_dev);
>  }

Re: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()

[Wei Yongjun]

Hi Jonathan,

On 2022/10/2 21:27, Jonathan Cameron wrote:
> On Wed, 28 Sep 2022 04:09:48 +0000
> Wei Yongjun <weiyongjun@huaweicloud.com> wrote:
> 
>> From: Wei Yongjun <weiyongjun1@huawei.com>
>>
>> KASAN report null-ptr-deref as follows:
>>
>> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
>> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
>> Call Trace:
>>  <TASK>
>>  ltc2496_probe+0xf4/0x150
>>  spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
>>  call_driver_probe drivers/base/dd.c:560 [inline]
>>  really_probe+0x207/0x750 drivers/base/dd.c:639
>>  __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
>>  device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
>>
>> This happend when probe ltc2496 device with spi device id but without
>> dts, device_get_match_data() return null chip_info. Fix it by adding
>> null check for chip_info in ltc2496_probe().
> 
> What tree are you based on?  When I look at this file I'm not seeing a
> spi_device_id table so how is it matching?
> 

When no spi_device_id tables exists, the driver name in ltc2496_driver
can be used as the spi_device_id for matching.


> Also I'd prefer a more comprehensive fix that ensured the same data is
> available via the spi_device_id table and uses that if
> device_get_match_data() == NULL.
> 

Got it, will fix in next version.


Regards,
Wei Yongjun