From patchwork Thu Jun 18 01:00:40 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gregory Fong X-Patchwork-Id: 6632491 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 08D8EC0020 for ; Thu, 18 Jun 2015 01:06:15 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 23E7520827 for ; Thu, 18 Jun 2015 01:06:14 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A3050207F1 for ; Thu, 18 Jun 2015 01:06:12 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1Z5OEj-0002z9-Ps; Thu, 18 Jun 2015 01:03:21 +0000 Received: from mail-pd0-x22e.google.com ([2607:f8b0:400e:c02::22e]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1Z5OEg-0002wO-8y for linux-arm-kernel@lists.infradead.org; Thu, 18 Jun 2015 01:03:18 +0000 Received: by pdjm12 with SMTP id m12so53200120pdj.3 for ; Wed, 17 Jun 2015 18:02:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=i0QJkVs/3WPhpXi9vKG+ZxGfKKbiJuKi7jGMM+INDlI=; b=Jd5SZhOld8QEF7rFJNjZcnbxJ694xVZuXmKMMwlVSeNIJthN8aR/LWJ/buuB7CitmI W7f+O230qJsJcC049gPoMEEiUuvB+XTNrCHaZItEGYKk/YDcHcpuz3B9q1/LrieG3hzK sjhu4ykCMxPv4qj75BCc8hZGAGtDggAf/mm5UNSR+0QlG5u0H04Aos3rnDQw1pwwQKhR zwwl679i9ze1W1Eg4I2PIOhUak5GwCLNoBObIfQcDVBSZLcYiedVpL5SHO8XXDwd+mm+ ZfQzd0wNKpOoL3nifJbUYlLUeLaZoQQ258Qs92TDl5cGUqxODZ/XETvhCujybsUhIEBv ivng== X-Received: by 10.70.108.137 with SMTP id hk9mr16025681pdb.105.1434589375366; Wed, 17 Jun 2015 18:02:55 -0700 (PDT) Received: from gregory-irv-00.broadcom.com (5520-maca-inet1-outside.broadcom.com. [216.31.211.11]) by mx.google.com with ESMTPSA id m3sm3293641pdd.29.2015.06.17.18.02.53 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 17 Jun 2015 18:02:54 -0700 (PDT) From: Gregory Fong To: linux-gpio@vger.kernel.org Subject: [PATCH v3 1/4] gpio: brcmstb: fix null ptr dereference in driver remove Date: Wed, 17 Jun 2015 18:00:40 -0700 Message-Id: <1434589243-502-2-git-send-email-gregory.0xf0@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1434589243-502-1-git-send-email-gregory.0xf0@gmail.com> References: <1434589243-502-1-git-send-email-gregory.0xf0@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150617_180318_366171_8A5E6288 X-CRM114-Status: GOOD ( 13.30 ) X-Spam-Score: -0.6 (/) Cc: Mark Rutland , Alexandre Courbot , Florian Fainelli , Russell King , Pawel Moll , devicetree@vger.kernel.org, Linus Walleij , Ian Campbell , linux-kernel@vger.kernel.org, Rob Herring , bcm-kernel-feedback-list@broadcom.com, Gregory Fong , Kumar Gala , Brian Norris , linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.7 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If a failure occurs during probe, brcmstb_gpio_remove() is called. In remove, we call platform_get_drvdata(), but at the time of failure in the probe the driver data hadn't yet been set which leads to a NULL ptr dereference in the remove's list_for_each. Call platform_set_drvdata() and set up list head right after allocating the priv struct to both avoid the null pointer dereference that could occur today. To guard against potential future changes, check for null pointer in remove. Reported-by: Tim Ross Signed-off-by: Gregory Fong --- New in v3. drivers/gpio/gpio-brcmstb.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c index 7a3cb1f..4630a81 100644 --- a/drivers/gpio/gpio-brcmstb.c +++ b/drivers/gpio/gpio-brcmstb.c @@ -87,6 +87,15 @@ static int brcmstb_gpio_remove(struct platform_device *pdev) struct brcmstb_gpio_bank *bank; int ret = 0; + if (!priv) { + dev_err(&pdev->dev, "called %s without drvdata!\n", __func__); + return -EFAULT; + } + + /* + * You can lose return values below, but we report all errors, and it's + * more important to actually perform all of the steps. + */ list_for_each(pos, &priv->bank_list) { bank = list_entry(pos, struct brcmstb_gpio_bank, node); ret = bgpio_remove(&bank->bgc); @@ -143,6 +152,8 @@ static int brcmstb_gpio_probe(struct platform_device *pdev) priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; + platform_set_drvdata(pdev, priv); + INIT_LIST_HEAD(&priv->bank_list); res = platform_get_resource(pdev, IORESOURCE_MEM, 0); reg_base = devm_ioremap_resource(dev, res); @@ -153,7 +164,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev) priv->reg_base = reg_base; priv->pdev = pdev; - INIT_LIST_HEAD(&priv->bank_list); if (brcmstb_gpio_sanity_check_banks(dev, np, res)) return -EINVAL; @@ -221,8 +231,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev) dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n", priv->num_banks, priv->gpio_base, gpio_base - 1); - platform_set_drvdata(pdev, priv); - return 0; fail: