From: Zheyu Ma <zheyuma97@gmail.com>
To: linux@dominikbrodowski.net
Cc: linux-kernel@vger.kernel.org, Zheyu Ma <zheyuma97@gmail.com>
Subject: [PATCH] pcmcia: i82092: fix a null pointer dereference bug
Date: Tue, 22 Jun 2021 07:11:31 +0000 [thread overview]
Message-ID: <1624345891-4215-1-git-send-email-zheyuma97@gmail.com> (raw)
During the driver loading process, the 'dev' field was not assigned, but
the 'dev' field was referenced in the subsequent 'i82092aa_set_mem_map'
function.
This log reveals it:
[ 3.928168] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 3.928678] #PF: supervisor read access in kernel mode
[ 3.929054] #PF: error_code(0x0000) - not-present page
[ 3.929428] PGD 0 P4D 0
[ 3.929617] Oops: 0000 [#1] PREEMPT SMP PTI
[ 3.929923] CPU: 3 PID: 4409 Comm: pccardd Not tainted 5.13.0-rc7-next-20210621 #1
[ 3.930468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.931277] RIP: 0010:i82092aa_set_mem_map+0x45/0x2c0
[ 3.931649] Code: 28 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 f0 44 8f fd 49 8b 84 24 28 09 00 00 48 8b 53 18 48 8d 75 c0 45 8b 6c 24 f0 <48> 8b 78 10 e8 92 05 2f fe 44 0f b6 33 41 80 fe 04 0f 87 16 02 00
[ 3.932973] RSP: 0000:ffffc9000a6bfdb8 EFLAGS: 00010293
[ 3.933351] RAX: 0000000000000000 RBX: ffffc9000a6bfe30 RCX: 0000000000000000
[ 3.933859] RDX: ffffc9000a6bfe50 RSI: ffffc9000a6bfdc8 RDI: ffffffff88457bb0
[ 3.934370] RBP: ffffc9000a6bfe08 R08: 0000000000000001 R09: 0000000000000001
[ 3.934876] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff88457bb0
[ 3.935385] R13: 0000000000000000 R14: ffffffff839f7b80 R15: ffffffff88457bb0
[ 3.935891] FS: 0000000000000000(0000) GS:ffff88817aa00000(0000) knlGS:0000000000000000
[ 3.936467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.936877] CR2: 0000000000000010 CR3: 0000000006c32000 CR4: 00000000000006e0
[ 3.937391] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.937896] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.938082] Call Trace:
[ 3.938082] ? pcmcia_parse_uevents+0xa0/0xa0
[ 3.938082] i82092aa_init+0xb8/0xf0
[ 3.938082] pccardd+0x64/0x590
[ 3.938082] ? __kthread_parkme+0xba/0xe0
[ 3.938082] ? pcmcia_parse_uevents+0xa0/0xa0
[ 3.938082] kthread+0x19a/0x1e0
[ 3.938082] ? set_kthread_struct+0x60/0x60
[ 3.938082] ret_from_fork+0x1f/0x30
[ 3.938082] Modules linked in:
[ 3.938082] Dumping ftrace buffer:
[ 3.938082] (ftrace buffer empty)
[ 3.938082] CR2: 0000000000000010
[ 3.938082] ---[ end trace f4f9ca1497f3c8b2 ]---
[ 3.938082] RIP: 0010:i82092aa_set_mem_map+0x45/0x2c0
[ 3.938082] Code: 28 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 f0 44 8f fd 49 8b 84 24 28 09 00 00 48 8b 53 18 48 8d 75 c0 45 8b 6c 24 f0 <48> 8b 78 10 e8 92 05 2f fe 44 0f b6 33 41 80 fe 04 0f 87 16 02 00
[ 3.938082] RSP: 0000:ffffc9000a6bfdb8 EFLAGS: 00010293
[ 3.938082] RAX: 0000000000000000 RBX: ffffc9000a6bfe30 RCX: 0000000000000000
[ 3.938082] RDX: ffffc9000a6bfe50 RSI: ffffc9000a6bfdc8 RDI: ffffffff88457bb0
[ 3.938082] RBP: ffffc9000a6bfe08 R08: 0000000000000001 R09: 0000000000000001
[ 3.938082] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff88457bb0
[ 3.938082] R13: 0000000000000000 R14: ffffffff839f7b80 R15: ffffffff88457bb0
[ 3.938082] FS: 0000000000000000(0000) GS:ffff88817aa00000(0000) knlGS:0000000000000000
3.938082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.938082] CR2: 0000000000000010 CR3: 0000000006c32000 CR4: 00000000000006e0
[ 3.938082] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.938082] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.938082] Kernel panic - not syncing: Fatal exception
[ 3.938082] Dumping ftrace buffer:
[ 3.938082] (ftrace buffer empty)
[ 3.938082] Kernel Offset: disabled
[ 3.938082] Rebooting in 1 seconds..
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
---
drivers/pcmcia/i82092.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index 85887d885b5f..192c9049d654 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -112,6 +112,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev,
for (i = 0; i < socket_count; i++) {
sockets[i].card_state = 1; /* 1 = present but empty */
sockets[i].io_base = pci_resource_start(dev, 0);
+ sockets[i].dev = dev;
sockets[i].socket.features |= SS_CAP_PCCARD;
sockets[i].socket.map_size = 0x1000;
sockets[i].socket.irq_mask = 0;
--
2.17.6
next reply other threads:[~2021-06-22 7:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-22 7:11 Zheyu Ma [this message]
2021-07-23 6:03 ` Dominik Brodowski
2021-07-23 9:48 ` Zheyu Ma
2021-07-23 14:51 ` Dominik Brodowski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1624345891-4215-1-git-send-email-zheyuma97@gmail.com \
--to=zheyuma97@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@dominikbrodowski.net \
--subject='Re: [PATCH] pcmcia: i82092: fix a null pointer dereference bug' \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).