| Message ID | 1466071989-24663-1-git-send-email-sudeep.holla@arm.com |
|---|---|
| State | Accepted |
| Commit | b8392153721c83de4e5d47ee455bbfefd0c8259e |
| Headers | show |
On 16 June 2016 at 04:13, Sudeep Holla <sudeep.holla@arm.com> wrote: > If the addition of the coresight devices get deferred, then there's a > window before child_name is populated by of_get_coresight_platform_data > from the respective component driver's probe and the attempted to access > the same from coresight_orphan_match resulting in kernel NULL pointer > dereference as below: > > Unable to handle kernel NULL pointer dereference at virtual address 0x0 > Internal error: Oops: 96000004 [#1] PREEMPT SMP > Modules linked in: > CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124 > Hardware name: ARM Juno development board (r2) (DT) > Workqueue: events amba_deferred_retry_func > PC is at strcmp+0x1c/0x160 > LR is at coresight_orphan_match+0x7c/0xd0 > Call trace: > strcmp+0x1c/0x160 > bus_for_each_dev+0x60/0xa0 > coresight_register+0x264/0x2e0 > tmc_probe+0x130/0x310 > amba_probe+0xd4/0x1c8 > driver_probe_device+0x22c/0x418 > __device_attach_driver+0xbc/0x158 > bus_for_each_drv+0x58/0x98 > __device_attach+0xc4/0x160 > device_initial_probe+0x10/0x18 > bus_probe_device+0x94/0xa0 > device_add+0x344/0x580 > amba_device_try_add+0x194/0x238 > amba_deferred_retry_func+0x48/0xd0 > process_one_work+0x118/0x378 > worker_thread+0x48/0x498 > kthread+0xd0/0xe8 > ret_from_fork+0x10/0x40 > > This patch adds a check for non-NULL conn->child_name before accessing > the same. > > Cc: Mathieu Poirier <mathieu.poirier@linaro.org> > Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> > --- > drivers/hwtracing/coresight/coresight.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c > index 5443d03a1eec..12ca4cd97f5b 100644 > --- a/drivers/hwtracing/coresight/coresight.c > +++ b/drivers/hwtracing/coresight/coresight.c > @@ -722,7 +722,8 @@ static int coresight_orphan_match(struct device *dev, void *data) > /* We have found at least one orphan connection */ > if (conn->child_dev == NULL) { > /* Does it match this newly added device? */ > - if (!strcmp(dev_name(&csdev->dev), conn->child_name)) { > + if (conn->child_name && > + !strcmp(dev_name(&csdev->dev), conn->child_name)) { > conn->child_dev = csdev; > } else { > /* This component still has an orphan */ > -- > 2.7.4 > Applied - thanks. Mathieu
diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c index 5443d03a1eec..12ca4cd97f5b 100644 --- a/drivers/hwtracing/coresight/coresight.c +++ b/drivers/hwtracing/coresight/coresight.c @@ -722,7 +722,8 @@ static int coresight_orphan_match(struct device *dev, void *data) /* We have found at least one orphan connection */ if (conn->child_dev == NULL) { /* Does it match this newly added device? */ - if (!strcmp(dev_name(&csdev->dev), conn->child_name)) { + if (conn->child_name && + !strcmp(dev_name(&csdev->dev), conn->child_name)) { conn->child_dev = csdev; } else { /* This component still has an orphan */
If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> --- drivers/hwtracing/coresight/coresight.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.7.4