From: <gregkh@linuxfoundation.org>
To: m.niestroj@grinn-global.com, gregkh@linuxfoundation.org,
jic23@kernel.org
Cc: <stable@vger.kernel.org>, <stable-commits@vger.kernel.org>
Subject: Patch "iio: trigger: fix NULL pointer dereference in iio_trigger_write_current()" has been added to the 4.11-stable tree
Date: Mon, 12 Jun 2017 10:55:18 +0200 [thread overview]
Message-ID: <149725771895124@kroah.com> (raw)
This is a note to let you know that I've just added the patch titled
iio: trigger: fix NULL pointer dereference in iio_trigger_write_current()
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
iio-trigger-fix-null-pointer-dereference-in-iio_trigger_write_current.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 4eecbe81885180c9f6217ecfd679b1f285967218 Mon Sep 17 00:00:00 2001
From: Marcin Niestroj <m.niestroj@grinn-global.com>
Date: Thu, 18 May 2017 09:12:06 +0200
Subject: iio: trigger: fix NULL pointer dereference in iio_trigger_write_current()
From: Marcin Niestroj <m.niestroj@grinn-global.com>
commit 4eecbe81885180c9f6217ecfd679b1f285967218 upstream.
In case oldtrig == trig == NULL (which happens when we set none
trigger, when there is already none set) there is a NULL pointer
dereference during iio_trigger_put(trig). Below is kernel output when
this occurs:
[ 26.741790] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 26.750179] pgd = cacc0000
[ 26.752936] [00000000] *pgd=8adc6835, *pte=00000000, *ppte=00000000
[ 26.759531] Internal error: Oops: 17 [#1] SMP ARM
[ 26.764261] Modules linked in: usb_f_ncm u_ether usb_f_acm u_serial usb_f_fs libcomposite configfs evbug
[ 26.773844] CPU: 0 PID: 152 Comm: synchro Not tainted 4.12.0-rc1 #2
[ 26.780128] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[ 26.786329] task: cb1de200 task.stack: cac92000
[ 26.790892] PC is at iio_trigger_write_current+0x188/0x1f4
[ 26.796403] LR is at lock_release+0xf8/0x20c
[ 26.800696] pc : [<c0736f34>] lr : [<c016efb0>] psr: 600d0013
[ 26.800696] sp : cac93e30 ip : cac93db0 fp : cac93e5c
[ 26.812193] r10: c0e64fe8 r9 : 00000000 r8 : 00000001
[ 26.817436] r7 : cb190810 r6 : 00000010 r5 : 00000001 r4 : 00000000
[ 26.823982] r3 : 00000000 r2 : 00000000 r1 : cb1de200 r0 : 00000000
[ 26.830528] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[ 26.837683] Control: 10c5387d Table: 8acc006a DAC: 00000051
[ 26.843448] Process synchro (pid: 152, stack limit = 0xcac92210)
[ 26.849475] Stack: (0xcac93e30 to 0xcac94000)
[ 26.853857] 3e20: 00000001 c0736dac c054033c cae6b680
[ 26.862060] 3e40: cae6b680 00000000 00000001 cb3f8610 cac93e74 cac93e60 c054035c c0736db8
[ 26.870264] 3e60: 00000001 c054033c cac93e94 cac93e78 c029bf34 c0540348 00000000 00000000
[ 26.878469] 3e80: cb3f8600 cae6b680 cac93ed4 cac93e98 c029b320 c029bef0 00000000 00000000
[ 26.886672] 3ea0: 00000000 cac93f78 cb2d41fc caed3280 c029b214 cac93f78 00000001 000e20f8
[ 26.894874] 3ec0: 00000001 00000000 cac93f44 cac93ed8 c0221dcc c029b220 c0e1ca39 cb2d41fc
[ 26.903079] 3ee0: cac93f04 cac93ef0 c0183ef0 c0183ab0 cb2d41fc 00000000 cac93f44 cac93f08
[ 26.911282] 3f00: c0225eec c0183ebc 00000001 00000000 c0223728 00000000 c0245454 00000001
[ 26.919485] 3f20: 00000001 caed3280 000e20f8 cac93f78 000e20f8 00000001 cac93f74 cac93f48
[ 26.927690] 3f40: c0223680 c0221da4 c0246520 c0245460 caed3283 caed3280 00000000 00000000
[ 26.935893] 3f60: 000e20f8 00000001 cac93fa4 cac93f78 c0224520 c02235e4 00000000 00000000
[ 26.944096] 3f80: 00000001 000e20f8 00000001 00000004 c0107f84 cac92000 00000000 cac93fa8
[ 26.952299] 3fa0: c0107de0 c02244e8 00000001 000e20f8 0000000e 000e20f8 00000001 fbad2484
[ 26.960502] 3fc0: 00000001 000e20f8 00000001 00000004 beb6b698 00064260 0006421c beb6b4b4
[ 26.968705] 3fe0: 00000000 beb6b450 b6f219a0 b6e2f268 800d0010 0000000e cac93ff4 cac93ffc
[ 26.976896] Backtrace:
[ 26.979388] [<c0736dac>] (iio_trigger_write_current) from [<c054035c>] (dev_attr_store+0x20/0x2c)
[ 26.988289] r10:cb3f8610 r9:00000001 r8:00000000 r7:cae6b680 r6:cae6b680 r5:c054033c
[ 26.996138] r4:c0736dac r3:00000001
[ 26.999747] [<c054033c>] (dev_attr_store) from [<c029bf34>] (sysfs_kf_write+0x50/0x54)
[ 27.007686] r5:c054033c r4:00000001
[ 27.011290] [<c029bee4>] (sysfs_kf_write) from [<c029b320>] (kernfs_fop_write+0x10c/0x224)
[ 27.019579] r7:cae6b680 r6:cb3f8600 r5:00000000 r4:00000000
[ 27.025271] [<c029b214>] (kernfs_fop_write) from [<c0221dcc>] (__vfs_write+0x34/0x120)
[ 27.033214] r10:00000000 r9:00000001 r8:000e20f8 r7:00000001 r6:cac93f78 r5:c029b214
[ 27.041059] r4:caed3280
[ 27.043622] [<c0221d98>] (__vfs_write) from [<c0223680>] (vfs_write+0xa8/0x170)
[ 27.050959] r9:00000001 r8:000e20f8 r7:cac93f78 r6:000e20f8 r5:caed3280 r4:00000001
[ 27.058731] [<c02235d8>] (vfs_write) from [<c0224520>] (SyS_write+0x44/0x98)
[ 27.065806] r9:00000001 r8:000e20f8 r7:00000000 r6:00000000 r5:caed3280 r4:caed3283
[ 27.073582] [<c02244dc>] (SyS_write) from [<c0107de0>] (ret_fast_syscall+0x0/0x1c)
[ 27.081179] r9:cac92000 r8:c0107f84 r7:00000004 r6:00000001 r5:000e20f8 r4:00000001
[ 27.088947] Code: 1a000009 e1a04009 e3a06010 e1a05008 (e5943000)
[ 27.095244] ---[ end trace 06d1dab86d6e6bab ]---
To fix that problem call iio_trigger_put(trig) only when trig is not
NULL.
Fixes: d5d24bcc0a10 ("iio: trigger: close race condition in acquiring trigger reference")
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-trigger.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -451,7 +451,8 @@ static ssize_t iio_trigger_write_current
return len;
out_trigger_put:
- iio_trigger_put(trig);
+ if (trig)
+ iio_trigger_put(trig);
return ret;
}
Patches currently in stable-queue which might be from m.niestroj@grinn-global.com are
queue-4.11/iio-trigger-fix-null-pointer-dereference-in-iio_trigger_write_current.patch
reply other threads:[~2017-06-12 8:55 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=149725771895124@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=jic23@kernel.org \
--cc=m.niestroj@grinn-global.com \
--cc=stable-commits@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.