| Message ID | 20220928040949.581092-1-weiyongjun@huaweicloud.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe() | expand |
> -----Original Message----- > From: Wei Yongjun <weiyongjun@huaweicloud.com> > Sent: Wednesday, September 28, 2022 6:10 AM > To: Lars-Peter Clausen <lars@metafoo.de>; Hennerich, Michael > <Michael.Hennerich@analog.com>; Jonathan Cameron <jic23@kernel.org>; > Regus, Ciprian <Ciprian.Regus@analog.com> > Cc: Wei Yongjun <weiyongjun1@huawei.com>; linux-iio@vger.kernel.org > Subject: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in > ltc2496_probe() > > [External] > > From: Wei Yongjun <weiyongjun1@huawei.com> > > KASAN report null-ptr-deref as follows: > > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] > CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 > 04/01/2014 > RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core] > Call Trace: > <TASK> > ltc2496_probe+0xf4/0x150 > spi_probe+0x158/0x1f0 drivers/spi/spi.c:421 > call_driver_probe drivers/base/dd.c:560 [inline] > really_probe+0x207/0x750 drivers/base/dd.c:639 > __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778 > device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105 > > This happend when probe ltc2496 device with spi device id but without > dts, device_get_match_data() return null chip_info. Fix it by adding > null check for chip_info in ltc2496_probe(). > > Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio > device") > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > Thanks! Reviewed-by: Nuno Sá <nuno.sa@analog.com>
On Wed, 28 Sep 2022 04:09:48 +0000 Wei Yongjun <weiyongjun@huaweicloud.com> wrote: > From: Wei Yongjun <weiyongjun1@huawei.com> > > KASAN report null-ptr-deref as follows: > > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] > CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core] > Call Trace: > <TASK> > ltc2496_probe+0xf4/0x150 > spi_probe+0x158/0x1f0 drivers/spi/spi.c:421 > call_driver_probe drivers/base/dd.c:560 [inline] > really_probe+0x207/0x750 drivers/base/dd.c:639 > __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778 > device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105 > > This happend when probe ltc2496 device with spi device id but without > dts, device_get_match_data() return null chip_info. Fix it by adding > null check for chip_info in ltc2496_probe(). What tree are you based on? When I look at this file I'm not seeing a spi_device_id table so how is it matching? Also I'd prefer a more comprehensive fix that ensured the same data is available via the spi_device_id table and uses that if device_get_match_data() == NULL. Jonathan > > Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device") > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > > diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c > index 2593fa4322eb..a7353c3dd006 100644 > --- a/drivers/iio/adc/ltc2496.c > +++ b/drivers/iio/adc/ltc2496.c > @@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi) > st->spi = spi; > st->common_ddata.result_and_measure = ltc2496_result_and_measure; > st->common_ddata.chip_info = device_get_match_data(dev); > + if (!st->common_ddata.chip_info) > + return -ENODEV; > > return ltc2497core_probe(dev, indio_dev); > }
Hi Jonathan, On 2022/10/2 21:27, Jonathan Cameron wrote: > On Wed, 28 Sep 2022 04:09:48 +0000 > Wei Yongjun <weiyongjun@huaweicloud.com> wrote: > >> From: Wei Yongjun <weiyongjun1@huawei.com> >> >> KASAN report null-ptr-deref as follows: >> >> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] >> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153 >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 >> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core] >> Call Trace: >> <TASK> >> ltc2496_probe+0xf4/0x150 >> spi_probe+0x158/0x1f0 drivers/spi/spi.c:421 >> call_driver_probe drivers/base/dd.c:560 [inline] >> really_probe+0x207/0x750 drivers/base/dd.c:639 >> __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778 >> device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105 >> >> This happend when probe ltc2496 device with spi device id but without >> dts, device_get_match_data() return null chip_info. Fix it by adding >> null check for chip_info in ltc2496_probe(). > > What tree are you based on? When I look at this file I'm not seeing a > spi_device_id table so how is it matching? > When no spi_device_id tables exists, the driver name in ltc2496_driver can be used as the spi_device_id for matching. > Also I'd prefer a more comprehensive fix that ensured the same data is > available via the spi_device_id table and uses that if > device_get_match_data() == NULL. > Got it, will fix in next version. Regards, Wei Yongjun
diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c index 2593fa4322eb..a7353c3dd006 100644 --- a/drivers/iio/adc/ltc2496.c +++ b/drivers/iio/adc/ltc2496.c @@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi) st->spi = spi; st->common_ddata.result_and_measure = ltc2496_result_and_measure; st->common_ddata.chip_info = device_get_match_data(dev); + if (!st->common_ddata.chip_info) + return -ENODEV; return ltc2497core_probe(dev, indio_dev); }