* Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-05-16 7:56 [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master YueHaibing
@ 2019-05-16 8:25 ` Geert Uytterhoeven
2019-05-16 8:36 ` Axel Lin
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Geert Uytterhoeven @ 2019-05-16 8:25 UTC (permalink / raw)
To: YueHaibing
Cc: Mark Brown, Axel Lin, Linux Kernel Mailing List, linux-spi,
albeu, Lorenzo Bianconi
On Thu, May 16, 2019 at 9:57 AM YueHaibing <yuehaibing@huawei.com> wrote:
> If spi_register_master fails in spi_bitbang_start
> because device_add failure, We should return the
> error code other than 0, otherwise calling
> spi_bitbang_stop may trigger NULL pointer dereference
> like this:
>
> BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
> Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661
[...]
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-05-16 7:56 [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master YueHaibing
2019-05-16 8:25 ` Geert Uytterhoeven
@ 2019-05-16 8:36 ` Axel Lin
2019-05-16 9:43 ` Mukesh Ojha
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Axel Lin @ 2019-05-16 8:36 UTC (permalink / raw)
To: YueHaibing; +Cc: Mark Brown, LKML, linux-spi, Alban Bedel, lorenzo.bianconi
YueHaibing <yuehaibing@huawei.com> 於 2019年5月16日 週四 下午3:57寫道：
>
> If spi_register_master fails in spi_bitbang_start
> because device_add failure, We should return the
> error code other than 0, otherwise calling
> spi_bitbang_stop may trigger NULL pointer dereference
> like this:
Reviewed-by: Axel Lin <axel.lin@ingics.com>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-05-16 7:56 [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master YueHaibing
2019-05-16 8:25 ` Geert Uytterhoeven
2019-05-16 8:36 ` Axel Lin
@ 2019-05-16 9:43 ` Mukesh Ojha
2019-05-16 9:51 ` Mark Brown
2019-05-16 10:17 ` Applied "spi: bitbang: Fix NULL pointer dereference in spi_unregister_master" to the spi tree Mark Brown
4 siblings, 0 replies; 7+ messages in thread
From: Mukesh Ojha @ 2019-05-16 9:43 UTC (permalink / raw)
To: YueHaibing, broonie, axel.lin
Cc: linux-kernel, linux-spi, albeu, lorenzo.bianconi
On 5/16/2019 1:26 PM, YueHaibing wrote:
> If spi_register_master fails in spi_bitbang_start
> because device_add failure, We should return the
> error code other than 0, otherwise calling
> spi_bitbang_stop may trigger NULL pointer dereference
> like this:
>
> BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
> Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661
>
> CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> Call Trace:
> dump_stack+0xa9/0x10e
> ? __list_del_entry_valid+0x45/0xd0
> ? __list_del_entry_valid+0x45/0xd0
> __kasan_report+0x171/0x18d
> ? __list_del_entry_valid+0x45/0xd0
> kasan_report+0xe/0x20
> __list_del_entry_valid+0x45/0xd0
> spi_unregister_controller+0x99/0x1b0
> spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
> ? 0xffffffffc1128000
> ? klist_next+0x131/0x1e0
> ? driver_detach+0x40/0x40 [parport]
> port_check+0x3b/0x50 [parport]
> bus_for_each_dev+0x115/0x180
> ? subsys_dev_iter_exit+0x20/0x20
> __parport_register_driver+0x1f0/0x210 [parport]
> ? 0xffffffffc1150000
> do_one_initcall+0xb9/0x3b5
> ? perf_trace_initcall_level+0x270/0x270
> ? kasan_unpoison_shadow+0x30/0x40
> ? kasan_unpoison_shadow+0x30/0x40
> do_init_module+0xe0/0x330
> load_module+0x38eb/0x4270
> ? module_frob_arch_sections+0x20/0x20
> ? kernel_read_file+0x188/0x3f0
> ? find_held_lock+0x6d/0xd0
> ? fput_many+0x1a/0xe0
> ? __do_sys_finit_module+0x162/0x190
> __do_sys_finit_module+0x162/0x190
> ? __ia32_sys_init_module+0x40/0x40
> ? __mutex_unlock_slowpath+0xb4/0x3f0
> ? wait_for_completion+0x240/0x240
> ? vfs_write+0x160/0x2a0
> ? lockdep_hardirqs_off+0xb5/0x100
> ? mark_held_locks+0x1a/0x90
> ? do_syscall_64+0x14/0x2a0
> do_syscall_64+0x72/0x2a0
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Cheers,
-Mukesh
> ---
> drivers/spi/spi-bitbang.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
> index dd9a8c54..be95be4 100644
> --- a/drivers/spi/spi-bitbang.c
> +++ b/drivers/spi/spi-bitbang.c
> @@ -403,7 +403,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
> if (ret)
> spi_master_put(master);
>
> - return 0;
> + return ret;
> }
> EXPORT_SYMBOL_GPL(spi_bitbang_start);
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-05-16 7:56 [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master YueHaibing
` (2 preceding siblings ...)
2019-05-16 9:43 ` Mukesh Ojha
@ 2019-05-16 9:51 ` Mark Brown
2019-05-16 13:27 ` YueHaibing
2019-05-16 10:17 ` Applied "spi: bitbang: Fix NULL pointer dereference in spi_unregister_master" to the spi tree Mark Brown
4 siblings, 1 reply; 7+ messages in thread
From: Mark Brown @ 2019-05-16 9:51 UTC (permalink / raw)
To: YueHaibing; +Cc: axel.lin, linux-kernel, linux-spi, albeu, lorenzo.bianconi
[-- Attachment #1: Type: text/plain, Size: 684 bytes --]
On Thu, May 16, 2019 at 03:56:56PM +0800, YueHaibing wrote:
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> Call Trace:
> dump_stack+0xa9/0x10e
> ? __list_del_entry_valid+0x45/0xd0
> ? __list_del_entry_valid+0x45/0xd0
> __kasan_report+0x171/0x18d
> ? __list_del_entry_valid+0x45/0xd0
> kasan_report+0xe/0x20
Please think hard before including complete backtraces in upstream
reports, they are very large and contain almost no useful information
relative to their size so often obscure the relevant content in your
message. If part of the backtrace is usefully illustrative then it's
usually better to pull out the relevant sections.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
2019-05-16 9:51 ` Mark Brown
@ 2019-05-16 13:27 ` YueHaibing
0 siblings, 0 replies; 7+ messages in thread
From: YueHaibing @ 2019-05-16 13:27 UTC (permalink / raw)
To: Mark Brown; +Cc: axel.lin, linux-kernel, linux-spi, albeu, lorenzo.bianconi
On 2019/5/16 17:51, Mark Brown wrote:
> On Thu, May 16, 2019 at 03:56:56PM +0800, YueHaibing wrote:
>
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
>> Call Trace:
>> dump_stack+0xa9/0x10e
>> ? __list_del_entry_valid+0x45/0xd0
>> ? __list_del_entry_valid+0x45/0xd0
>> __kasan_report+0x171/0x18d
>> ? __list_del_entry_valid+0x45/0xd0
>> kasan_report+0xe/0x20
>
> Please think hard before including complete backtraces in upstream
> reports, they are very large and contain almost no useful information
> relative to their size so often obscure the relevant content in your
> message. If part of the backtrace is usefully illustrative then it's
> usually better to pull out the relevant sections.
Thanks, got it.
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Applied "spi: bitbang: Fix NULL pointer dereference in spi_unregister_master" to the spi tree
2019-05-16 7:56 [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master YueHaibing
` (3 preceding siblings ...)
2019-05-16 9:51 ` Mark Brown
@ 2019-05-16 10:17 ` Mark Brown
4 siblings, 0 replies; 7+ messages in thread
From: Mark Brown @ 2019-05-16 10:17 UTC (permalink / raw)
To: YueHaibing
Cc: albeu, axel.lin, broonie, Hulk Robot, linux-kernel, linux-spi,
lorenzo.bianconi, Mark Brown
The patch
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
has been applied to the spi tree at
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-5.2
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
From 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Thu, 16 May 2019 15:56:56 +0800
Subject: [PATCH] spi: bitbang: Fix NULL pointer dereference in
spi_unregister_master
If spi_register_master fails in spi_bitbang_start
because device_add failure, We should return the
error code other than 0, otherwise calling
spi_bitbang_stop may trigger NULL pointer dereference
like this:
BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661
CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
dump_stack+0xa9/0x10e
? __list_del_entry_valid+0x45/0xd0
? __list_del_entry_valid+0x45/0xd0
__kasan_report+0x171/0x18d
? __list_del_entry_valid+0x45/0xd0
kasan_report+0xe/0x20
__list_del_entry_valid+0x45/0xd0
spi_unregister_controller+0x99/0x1b0
spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
? 0xffffffffc1128000
? klist_next+0x131/0x1e0
? driver_detach+0x40/0x40 [parport]
port_check+0x3b/0x50 [parport]
bus_for_each_dev+0x115/0x180
? subsys_dev_iter_exit+0x20/0x20
__parport_register_driver+0x1f0/0x210 [parport]
? 0xffffffffc1150000
do_one_initcall+0xb9/0x3b5
? perf_trace_initcall_level+0x270/0x270
? kasan_unpoison_shadow+0x30/0x40
? kasan_unpoison_shadow+0x30/0x40
do_init_module+0xe0/0x330
load_module+0x38eb/0x4270
? module_frob_arch_sections+0x20/0x20
? kernel_read_file+0x188/0x3f0
? find_held_lock+0x6d/0xd0
? fput_many+0x1a/0xe0
? __do_sys_finit_module+0x162/0x190
__do_sys_finit_module+0x162/0x190
? __ia32_sys_init_module+0x40/0x40
? __mutex_unlock_slowpath+0xb4/0x3f0
? wait_for_completion+0x240/0x240
? vfs_write+0x160/0x2a0
? lockdep_hardirqs_off+0xb5/0x100
? mark_held_locks+0x1a/0x90
? do_syscall_64+0x14/0x2a0
do_syscall_64+0x72/0x2a0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
drivers/spi/spi-bitbang.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index 4243e53f9f7b..e8fd95276315 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -415,7 +415,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
if (ret)
spi_master_put(master);
- return 0;
+ return ret;
}
EXPORT_SYMBOL_GPL(spi_bitbang_start);
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread