Re: [REGRESSION] brcmfmac: NULL pointer deference starting next-20181107

[Jon Hunter <jonathanh@nvidia.com>]

Hi Arend,

On 13/11/2018 10:24, Arend van Spriel wrote:

...

> I tried building drivers/firmware/efi/vars.c using tegra_defconfig. Had
> to enable CONFIG_EFI. So the null pointer access is a 0x00000008 so I
> looked at the disassembly below:
> 
> int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
> {
>      310:       e1a05001        mov     r5, r1
>         const struct efivar_operations *ops = __efivars->ops;
> ==>  314:       e5936008        ldr     r6, [r3, #8]
> 
> So I think __efivars is NULL on your platform. It is private to the
> source file. Not sure how the driver should deal with this. Maybe use
> efi_enabled() but not sure what feature to use. My best bet would be
> EFI_RUNTIME_SERVICES.
> 
>         efi_status_t status;
> 
>         *size = 0;
>      318:       e3a03000        mov     r3, #0
>      31c:       e5813000        str     r3, [r1]
> 
>         if (down_interruptible(&efivars_lock))
>      320:       ebfffffe        bl      0 <down_interruptible>
>      324:       e2504000        subs    r4, r0, #0
>      328:       1a000012        bne     378 <efivar_entry_size+0x80>
>                 return -EINTR;
>         status = ops->get_variable(entry->var.VariableName,

So actually, I am seeing the crash with the 'multi_v7_defconfig' and I
don't see it with the 'tegra_defconfig' (probably because CONFIG_EFI is
not enabled).

Cheers
Jon

-- 
nvpublic