From patchwork Thu Mar 8 19:47:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10268965 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1FDCF602C8 for ; Thu, 8 Mar 2018 19:48:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0DE1529B1B for ; Thu, 8 Mar 2018 19:48:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 01DA129B1D; Thu, 8 Mar 2018 19:48:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 77D0B29B1B for ; Thu, 8 Mar 2018 19:48:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:To:Subject:Message-ID:Date:From: References:In-Reply-To:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=kI4y7cyk6CofKqSXnScLJ2hBDgK7pdHj9ErKe1SatV8=; b=TGj+AjYKrJlAW6 NowhUv6MmRPXAUF4kK/rIG8OGEdhXZgwMMUaej+LHtMmBxVk++WyKfErVglo/eT/tJ7T8Bu6RyONw 2Day0/X3qXV4VTQUGR6joD+VcDcm7y0HdKwAhHoNciCdxZx4GSvjrN5OS9dMSDQZ81XVl7R4oCglj rEOFZcISU1hc5xkZYoSISY1Aybu0WkSo7QcC3kGlAjMIF/xDRn0p2AwrI96PQUS85F1ACwWmML2Bc Kg6S5I8gc9Jt7fYKy/r60eXaQtrPQvZuAmiOniUOXq8ohEAECAaJMmmsgaWXEdj8hI7traKyxAAVg NWU5YZkoMobYUtCLN/HQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eu1WI-0008L7-Ge; Thu, 08 Mar 2018 19:48:06 +0000 Received: from mail-ua0-x241.google.com ([2607:f8b0:400c:c08::241]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eu1WE-0008Jf-VX for linux-arm-kernel@lists.infradead.org; Thu, 08 Mar 2018 19:48:04 +0000 Received: by mail-ua0-x241.google.com with SMTP id c14so652424uak.7 for ; Thu, 08 Mar 2018 11:47:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=sfLCC9HX+D/YbU+bekiWzERsATQLui3PRNdOv6kT5mqMqBi4kM/saQlYF55ImLA/eP UHtJeAUn74DCqXLGqApFLL7Y2vmnnLZe9l8ozhDqEFLBFbKA6uW4ArMEFIGppFjKgXlp uYLXnXb8+64fqlW0qcf/3NMBwlyp1Vb6Q9THhxKtVy5sppA2GH1Sy3z+YYP9GDY9Bu6W mb9RX87EClzw18uwgLhzKkqwwA9dpxkvRC0CdC1oBeM1WsnHW1m10qgbciLlDduDxSG1 4zd9tGn+wuZyt4id9fhmSYXnfytB2jJPpqA/2bJxcfA11+CwCmyW8Rd0vhLGOPM02Ime a0/g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=Nl5n0DPLMybCdsm0B3QpxqKWHJib930flKWsCPfalM6lCLrRSmLSWyV6qjb9GIyIrL mJkeSG/fTNpxmTiYJ/JhqQ0Qj+pFs5rz97L7RpokwtxSwHJ7MF9mlaCZB4Fo3SqE4lDP eJpaRH0XvhZMRv/zX53oXvyHM3mPcYJBDcBvo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=f/Mk3zFnOHB2TxmD65m5NPRmfocl19z+IBlskNQYYlNivfhnTpw50wti9d+Caf/C7w kcRKdiirG490mun0RZ1wIjvM0J722Z8aqmvEEnVWocdsqO6E/56vKVKS5wNMozsFnW93 qBMIipNTN3KKHw9l55zL+j0g/JEd/05jOotWMOc32pLuk4uXDXiGBI4YAph2TqCUzHOl Kc02XH90hLw3Z+Sp4ZB6khbwPwd1ZREqPGPh/WhNu7U3HSZdid2WmZsZzL4EDYLUULkc mGdwEmgMg+Bmu2EG1xqLEJ6vxikq7leNl4DsfOJOKnUpAcYQMOQe0yqS2AcnfQLb4rVi bKkw== X-Gm-Message-State: APf1xPD5Hs6WReIGyJlvEQmNHxGuOKP95uqSj9BhzKUx+n2MZDPXmrXB Y3iEYFrd+BZvBvKMDmXpDU81px83B82e9PRWYU/fYQ== X-Google-Smtp-Source: AG47ELuYLIsyGuehK67x5OBRB4CFXXvODyS1XzmSvB4OD86Iopv3+a2SPglm+vgZQc0wsM+++J6PtoxDgDfbG6jI+ew= X-Received: by 10.159.36.243 with SMTP id 106mr19684148uar.83.1520538470921; Thu, 08 Mar 2018 11:47:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.242.140 with HTTP; Thu, 8 Mar 2018 11:47:50 -0800 (PST) In-Reply-To: <20180308151421.GA13160@amd> References: <20180308151421.GA13160@amd> From: Kees Cook Date: Thu, 8 Mar 2018 11:47:50 -0800 X-Google-Sender-Auth: FuBMPf4G7lXy9j0eo0kSLeeI508 Message-ID: Subject: Re: linux-next on n900: oops in codec_reg_show() when grepping sysfs To: Pavel Machek X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180308_114803_073083_D479F7A1 X-CRM114-Status: GOOD ( 15.73 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.ujfalusi@ti.com, moderated for non-subscribers , ivo.g.dimitrov.75@gmail.com, Kevin Hilman , Tony Lindgren , security@kernel.org, Aaro Koskinen , kernel list , sre@kernel.org, martijn@brixit.nl, =?UTF-8?Q?Filip_Matijevi=C4=87?= , Mark Brown , abcloriens@gmail.com, Sakari Ailus , pali.rohar@gmail.com, Clayton Craft , linux-omap@vger.kernel.org, patrikbachan@gmail.com, linux-arm-kernel , "Serge E. Hallyn" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Mar 8, 2018 at 7:14 AM, Pavel Machek wrote: > Hi! > > pavel@n900:/sys$ uname -a > Linux n900 4.16.0-rc4-next-20180308 #71 Thu Mar 8 15:27:49 CET 2018 > armv7l GNU/Linux > pavel@n900:/sys$ grep -ri fasdfasdf . > > leads to an oops: > > [ 2278.331878] DSS: context saved > [ 2278.820343] Unable to handle kernel NULL pointer dereference at > virtual address 00000004 > [ 2278.828948] pgd = c36040a2 > [ 2278.831787] [00000004] *pgd=876c4831, *pte=00000000, *ppte=00000000 > [ 2278.838439] Internal error: Oops: 17 [#1] ARM > [ 2278.843017] Modules linked in: > [ 2278.846221] CPU: 0 PID: 16337 Comm: grep Tainted: G W > 4.16.0-rc4-next-20180308 #71 > [ 2278.855529] Hardware name: Nokia RX-51 board > [ 2278.860015] PC is at soc_codec_reg_show+0x8/0x19c > [ 2278.864959] LR is at codec_reg_show+0x28/0x30 Looks like a NULL codec (driver has offsetof of 0x4). static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t count, loff_t pos) { ... loff_t p = 0; wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2; ... This would paper over it. I have no idea that the lifetime expectation are for codec and driver... -Kees diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 96c44f6576c9..78ad165ad424 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -137,6 +137,9 @@ static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t total = 0; loff_t p = 0; + if (!codec || !codec->driver) + return 0; + wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2;