From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pa0-x22b.google.com ([2607:f8b0:400e:c03::22b]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZXbCY-0002Mz-1m for linux-mtd@lists.infradead.org; Thu, 03 Sep 2015 20:33:42 +0000 Received: by pacfv12 with SMTP id fv12so969645pac.2 for ; Thu, 03 Sep 2015 13:33:20 -0700 (PDT) Date: Thu, 3 Sep 2015 13:33:18 -0700 From: Brian Norris To: linux-mtd@lists.infradead.org Cc: =?utf-8?B?UmFmYcWCIE1pxYJlY2tp?= Subject: Re: [PATCH] mtd: spi-nor: fix NULL dereference when no match found in spi_nor_ids[] Message-ID: <20150903203318.GC81844@google.com> References: <1441237380-18522-1-git-send-email-computersforpeace@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1441237380-18522-1-git-send-email-computersforpeace@gmail.com> List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Wed, Sep 02, 2015 at 04:43:00PM -0700, Brian Norris wrote: > Commit 06bb6f5a69df ("mtd: spi-nor: stop (ab)using struct > spi_device_id") converted an array into a pointer, which means that > we should be checking if the pointer goes anywhere, not whether the C > string is empty. To do the latter means we dereference a NULL pointer > when we reach the terminating entry, for which 'name' is now NULL > instead of an array { 0, 0, ... }. > > Sample crash: > > [ 1.101371] Unable to handle kernel NULL pointer dereference at virtual address 00000000 > [ 1.109457] pgd = c0004000 > [ 1.112157] [00000000] *pgd=00000000 > [ 1.115736] Internal error: Oops: 5 [#1] SMP ARM > [ 1.120345] Modules linked in: > [ 1.123405] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.2.0-next-20150902+ #61 > [ 1.130611] Hardware name: Rockchip (Device Tree) > [ 1.135306] task: ee0b8d40 ti: ee0ba000 task.ti: ee0ba000 > [ 1.140697] PC is at spi_nor_scan+0x90/0x8c4 > [ 1.144958] LR is at spi_nor_scan+0xa4/0x8c4 > ... > [ 1.504112] [] (spi_nor_scan) from [] (m25p_probe+0xc8/0x11c) > [ 1.511583] [] (m25p_probe) from [] (spi_drv_probe+0x60/0x7c) > [ 1.519055] [] (spi_drv_probe) from [] (driver_probe_device+0x1a0/0x444) > [ 1.527478] [] (driver_probe_device) from [] (__device_attach_driver+0x94/0xa0) > [ 1.536507] [] (__device_attach_driver) from [] (bus_for_each_drv+0x94/0xa4) > [ 1.545277] [] (bus_for_each_drv) from [] (__device_attach+0xa4/0x144) > [ 1.553526] [] (__device_attach) from [] (device_initial_probe+0x1c/0x20) > [ 1.562035] [] (device_initial_probe) from [] (bus_probe_device+0x38/0x94) > [ 1.570631] [] (bus_probe_device) from [] (device_add+0x430/0x558) > [ 1.578534] [] (device_add) from [] (spi_add_device+0xe4/0x174) > [ 1.586178] [] (spi_add_device) from [] (spi_register_master+0x698/0x7d4) > [ 1.594688] [] (spi_register_master) from [] (devm_spi_register_master+0x40/0x7c) > [ 1.603892] [] (devm_spi_register_master) from [] (rockchip_spi_probe+0x360/0x3f4) > [ 1.613182] [] (rockchip_spi_probe) from [] (platform_drv_probe+0x58/0xa8) > [ 1.621779] [] (platform_drv_probe) from [] (driver_probe_device+0x1a0/0x444) > [ 1.630635] [] (driver_probe_device) from [] (__driver_attach+0x80/0xa4) > [ 1.639058] [] (__driver_attach) from [] (bus_for_each_dev+0x98/0xac) > [ 1.647221] [] (bus_for_each_dev) from [] (driver_attach+0x28/0x30) > [ 1.655210] [] (driver_attach) from [] (bus_add_driver+0x128/0x250) > [ 1.663200] [] (bus_add_driver) from [] (driver_register+0xac/0xf0) > [ 1.671191] [] (driver_register) from [] (__platform_driver_register+0x58/0x6c) > [ 1.680221] [] (__platform_driver_register) from [] (rockchip_spi_driver_init+0x18/0x20) > [ 1.690033] [] (rockchip_spi_driver_init) from [] (do_one_initcall+0x124/0x1dc) > [ 1.699063] [] (do_one_initcall) from [] (kernel_init_freeable+0x218/0x2ec) > [ 1.707748] [] (kernel_init_freeable) from [] (kernel_init+0x1c/0xf4) > [ 1.715912] [] (kernel_init) from [] (ret_from_fork+0x14/0x24) > [ 1.723460] Code: e3510000 159f67c0 0a00000c e5961000 (e5d13000) > [ 1.729564] ---[ end trace 95baa6b3b861ce25 ]--- > > Fixes: 06bb6f5a69df ("mtd: spi-nor: stop (ab)using struct spi_device_id") > Signed-off-by: Brian Norris > Cc: Rafał Miłecki Pushed to l2-mtd.git. I'll need to get this into 4.3-rc1 quick, since the buggy patch just made it in this week... Brian