From patchwork Thu Jun 16 10:13:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sudeep Holla X-Patchwork-Id: 70165 Delivered-To: patch@linaro.org Received: by 10.140.28.4 with SMTP id 4csp179729qgy; Thu, 16 Jun 2016 03:13:26 -0700 (PDT) X-Received: by 10.107.34.77 with SMTP id i74mr5966352ioi.39.1466072006344; Thu, 16 Jun 2016 03:13:26 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b66si5329369pfb.21.2016.06.16.03.13.26; Thu, 16 Jun 2016 03:13:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754010AbcFPKNX (ORCPT + 30 others); Thu, 16 Jun 2016 06:13:23 -0400 Received: from foss.arm.com ([217.140.101.70]:42650 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751323AbcFPKNV (ORCPT ); Thu, 16 Jun 2016 06:13:21 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6E6A0F; Thu, 16 Jun 2016 03:13:57 -0700 (PDT) Received: from e107155-lin.cambridge.arm.com (unknown [10.1.207.44]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id BA3A23F246; Thu, 16 Jun 2016 03:13:14 -0700 (PDT) From: Sudeep Holla To: linux-kernel@vger.kernel.org, Mathieu Poirier Cc: Sudeep Holla , linux-arm-kernel@lists.infradead.org, Suzuki K Poulose Subject: [PATCH] coresight: access conn->child_name only if it's initialised Date: Thu, 16 Jun 2016 11:13:09 +0100 Message-Id: <1466071989-24663-1-git-send-email-sudeep.holla@arm.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If the addition of the coresight devices get deferred, then there's a window before child_name is populated by of_get_coresight_platform_data from the respective component driver's probe and the attempted to access the same from coresight_orphan_match resulting in kernel NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual address 0x0 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124 Hardware name: ARM Juno development board (r2) (DT) Workqueue: events amba_deferred_retry_func PC is at strcmp+0x1c/0x160 LR is at coresight_orphan_match+0x7c/0xd0 Call trace: strcmp+0x1c/0x160 bus_for_each_dev+0x60/0xa0 coresight_register+0x264/0x2e0 tmc_probe+0x130/0x310 amba_probe+0xd4/0x1c8 driver_probe_device+0x22c/0x418 __device_attach_driver+0xbc/0x158 bus_for_each_drv+0x58/0x98 __device_attach+0xc4/0x160 device_initial_probe+0x10/0x18 bus_probe_device+0x94/0xa0 device_add+0x344/0x580 amba_device_try_add+0x194/0x238 amba_deferred_retry_func+0x48/0xd0 process_one_work+0x118/0x378 worker_thread+0x48/0x498 kthread+0xd0/0xe8 ret_from_fork+0x10/0x40 This patch adds a check for non-NULL conn->child_name before accessing the same. Cc: Mathieu Poirier Signed-off-by: Sudeep Holla --- drivers/hwtracing/coresight/coresight.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.7.4 diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c index 5443d03a1eec..12ca4cd97f5b 100644 --- a/drivers/hwtracing/coresight/coresight.c +++ b/drivers/hwtracing/coresight/coresight.c @@ -722,7 +722,8 @@ static int coresight_orphan_match(struct device *dev, void *data) /* We have found at least one orphan connection */ if (conn->child_dev == NULL) { /* Does it match this newly added device? */ - if (!strcmp(dev_name(&csdev->dev), conn->child_name)) { + if (conn->child_name && + !strcmp(dev_name(&csdev->dev), conn->child_name)) { conn->child_dev = csdev; } else { /* This component still has an orphan */