From patchwork Tue Jul 18 12:07:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Milan Zamazal X-Patchwork-Id: 13317080 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8328FEB64DA for ; Tue, 18 Jul 2023 12:09:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231224AbjGRMJY (ORCPT ); Tue, 18 Jul 2023 08:09:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38460 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232398AbjGRMJM (ORCPT ); Tue, 18 Jul 2023 08:09:12 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1726170F for ; Tue, 18 Jul 2023 05:07:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1689682048; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yjWCLI452VH7qr/ipPngolmC3Xdx62iryCFAqOd/N2M=; b=Nlbdy+8zN06sK594K73uXYpF++tnzhbT9AbcNcmJcXg6sTqy4wvnhiTvLKRuE7o+hHiwXr txaeiwFL7gjyeSA9xGxa1yiSK2Oxz4juEGYjXV86QZX/ZUolE0MY2Q3a6Z+yVHlZUC43fB 0wVBcq2Kvnc21cbOpiG6RbQVBBuSNgg= Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-639-Ldm-cCfpM7i3Ho1AXClnvg-1; Tue, 18 Jul 2023 08:07:23 -0400 X-MC-Unique: Ldm-cCfpM7i3Ho1AXClnvg-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 56D67380391B; Tue, 18 Jul 2023 12:07:23 +0000 (UTC) Received: from localhost.localdomain (unknown [10.34.131.165]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4A3E14CD0F5; Tue, 18 Jul 2023 12:07:22 +0000 (UTC) From: Milan Zamazal To: linux-iio@vger.kernel.org Cc: Milan Zamazal , linux-kernel@vger.kernel.org, Jonathan Cameron , Lars-Peter Clausen , Andy Shevchenko Subject: [PATCH] iio: core: Prevent invalid memory access when there is no parent Date: Tue, 18 Jul 2023 14:07:00 +0200 Message-Id: <20230718120700.132579-1-mzamazal@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.10 Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org Commit 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") switched the kind of nodes to use for label retrieval in device registration. Probably an unwanted change in that commit was that if the device has no parent then NULL pointer is accessed. This is what happens in the stock IIO dummy driver when a new entry is created in configfs: # mkdir /sys/kernel/config/iio/devices/dummy/foo BUG: kernel NULL pointer dereference, address: 0000000000000278 ... ? asm_exc_page_fault+0x22/0x30 ? container_offline+0x20/0x20 __iio_device_register+0x45/0xc10 ? krealloc+0x73/0xa0 ? iio_device_attach_buffer+0x31/0xc0 ? iio_simple_dummy_configure_buffer+0x20/0x20 ? iio_triggered_buffer_setup_ext+0xb4/0x100 iio_dummy_probe+0x112/0x190 iio_sw_device_create+0xa8/0xd0 device_make_group+0xe/0x40 configfs_mkdir+0x1a6/0x440 Since there seems to be no reason to make a parent device of an IIO dummy device mandatory, let’s prevent the invalid memory access in __iio_device_register when the parent device is NULL. With this change, the IIO dummy driver works fine with configfs. Fixes: 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") Signed-off-by: Milan Zamazal Reviewed-by: Nuno Sa --- drivers/iio/industrialio-core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index c117f50d0cf3..229527b3434a 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -1888,7 +1888,7 @@ static const struct iio_buffer_setup_ops noop_ring_setup_ops; int __iio_device_register(struct iio_dev *indio_dev, struct module *this_mod) { struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev); - struct fwnode_handle *fwnode; + struct fwnode_handle *fwnode = NULL; int ret; if (!indio_dev->info) @@ -1899,11 +1899,12 @@ int __iio_device_register(struct iio_dev *indio_dev, struct module *this_mod) /* If the calling driver did not initialize firmware node, do it here */ if (dev_fwnode(&indio_dev->dev)) fwnode = dev_fwnode(&indio_dev->dev); - else + else if (indio_dev->dev.parent != NULL) fwnode = dev_fwnode(indio_dev->dev.parent); - device_set_node(&indio_dev->dev, fwnode); - - fwnode_property_read_string(fwnode, "label", &indio_dev->label); + if (fwnode != NULL) { + device_set_node(&indio_dev->dev, fwnode); + fwnode_property_read_string(fwnode, "label", &indio_dev->label); + } ret = iio_check_unique_scan_index(indio_dev); if (ret < 0)