[PATCH 1/3] Input: apanel: avoid panic if ioreamp fails

[PATCH 1/3] Input: apanel: avoid panic if ioreamp fails

[Kefeng Wang]

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: linux-input@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/input/misc/apanel.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/misc/apanel.c b/drivers/input/misc/apanel.c
index c1e66f45d552..1c7262ad4b5b 100644
--- a/drivers/input/misc/apanel.c
+++ b/drivers/input/misc/apanel.c
@@ -259,7 +259,9 @@ static int __init apanel_init(void)
 	unsigned char i2c_addr;
 	int found = 0;
 
-	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
+	bios = ioremap(0xF0000, 0x10000);
+	if (!bios)
+		return -ENOMEM;
 
 	p = bios_signature(bios);
 	if (!p) {
-- 
2.20.1

[PATCH 2/3] Input: wistron_btns: avoid panic if ioreamp fails

[Kefeng Wang]

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Miloslav Trmac <mitr@volny.cz>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-input@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/input/misc/wistron_btns.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 43e67f546366..a82ec3d102b4 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -107,7 +107,10 @@ static int __init map_bios(void)
 	ssize_t offset;
 	u32 entry_point;
 
-	base = ioremap(0xF0000, 0x10000); /* Can't fail */
+	base = ioremap(0xF0000, 0x10000);
+	if (!base)
+		return -ENOMEM;
+
 	offset = locate_wistron_bios(base);
 	if (offset < 0) {
 		printk(KERN_ERR "wistron_btns: BIOS entry point not found\n");
-- 
2.20.1

[PATCH 3/3] i2c: i801: avoid panic if ioreamp fails

[Kefeng Wang]

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Jean Delvare <jdelvare@suse.com>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-i2c@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/i2c/busses/i2c-i801.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 679c6c41f64b..fc6ccb8aba17 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
 	void __iomem *bios;
 	const void __iomem *p;
 
-	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
+	bios = ioremap(0xF0000, 0x10000);
+	if (!base)
+		return -ENOMEM;
+
 	p = bios_signature(bios);
 	if (p) {
 		/* just use the first address */
-- 
2.20.1

Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails

[Jean Delvare]

Hi Kefeng,

On Fri, 10 May 2019 11:03:20 +0800, Kefeng Wang wrote:
> If ioremap fails, NULL pointer dereference will happen and
> leading to a kernel panic when access the virtual address
> in check_signature().
> 
> Fix it by check the return value of ioremap.
> 
> Cc: Jean Delvare <jdelvare@suse.com>
> Cc: Wolfram Sang <wsa@the-dreams.de>
> Cc: linux-i2c@vger.kernel.org
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
>  drivers/i2c/busses/i2c-i801.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
> index 679c6c41f64b..fc6ccb8aba17 100644
> --- a/drivers/i2c/busses/i2c-i801.c
> +++ b/drivers/i2c/busses/i2c-i801.c
> @@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
>  	void __iomem *bios;
>  	const void __iomem *p;
>  
> -	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
> +	bios = ioremap(0xF0000, 0x10000);
> +	if (!base)

That would be "if (!bios)". Please don't send patches without at least
test-building the result.

We don't need this anyway. The comment says it can't fail, so why
bother checking for a condition which will never happen?

> +		return -ENOMEM;
> +
>  	p = bios_signature(bios);
>  	if (p) {
>  		/* just use the first address */


-- 
Jean Delvare
SUSE L3 Support

Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails

[Kefeng Wang]

On 2019/5/10 16:09, Jean Delvare wrote:
> Hi Kefeng,
>
> On Fri, 10 May 2019 11:03:20 +0800, Kefeng Wang wrote:
>> If ioremap fails, NULL pointer dereference will happen and
>> leading to a kernel panic when access the virtual address
>> in check_signature().
>>
>> Fix it by check the return value of ioremap.
>>
>> Cc: Jean Delvare <jdelvare@suse.com>
>> Cc: Wolfram Sang <wsa@the-dreams.de>
>> Cc: linux-i2c@vger.kernel.org
>> Reported-by: Hulk Robot <hulkci@huawei.com>
>> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
>> ---
>>  drivers/i2c/busses/i2c-i801.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
>> index 679c6c41f64b..fc6ccb8aba17 100644
>> --- a/drivers/i2c/busses/i2c-i801.c
>> +++ b/drivers/i2c/busses/i2c-i801.c
>> @@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
>>  	void __iomem *bios;
>>  	const void __iomem *p;
>>  
>> -	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
>> +	bios = ioremap(0xF0000, 0x10000);
>> +	if (!base)
> That would be "if (!bios)". Please don't send patches without at least
> test-building the result.
sorry,  copy error.

> We don't need this anyway. The comment says it can't fail, so why
> bother checking for a condition which will never happen?

The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)

find this issue.


>
>> +		return -ENOMEM;
>> +
>>  	p = bios_signature(bios);
>>  	if (p) {
>>  		/* just use the first address */
>

Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails

[Jean Delvare]

On Fri, 10 May 2019 17:35:46 +0800, Kefeng Wang wrote:
> On 2019/5/10 16:09, Jean Delvare wrote:
> > We don't need this anyway. The comment says it can't fail, so why
> > bother checking for a condition which will never happen?  
> 
> The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)
> 
> find this issue.

The code only runs on x86 where this specific memory segment is
standardized for the purpose. That's how we know it "can't fail".

That being said, maybe it could fail for other reasons (internal kernel
bug, or bogus BIOS maybe), and I don't care adding the check
anyway, as this code path is not performance critical.

-- 
Jean Delvare
SUSE L3 Support

Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails

[Kefeng Wang]

On 2019/5/10 20:18, Jean Delvare wrote:
> On Fri, 10 May 2019 17:35:46 +0800, Kefeng Wang wrote:
>> On 2019/5/10 16:09, Jean Delvare wrote:
>>> We don't need this anyway. The comment says it can't fail, so why
>>> bother checking for a condition which will never happen?  
>> The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)
>>
>> find this issue.
> The code only runs on x86 where this specific memory segment is
> standardized for the purpose. That's how we know it "can't fail".
>
> That being said, maybe it could fail for other reasons (internal kernel
> bug, or bogus BIOS maybe), and I don't care adding the check
> anyway, as this code path is not performance critical.
Got it , please ignore it.
>