From: Kees Cook <keescook@chromium.org>
To: John Stultz <jstultz@google.com>
Cc: Yongqin Liu <yongqin.liu@linaro.org>,
Vlastimil Babka <vbabka@suse.cz>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Rasmus Villemoes <rasmus.villemoes@prevas.dk>,
Thomas Gleixner <tglx@linutronix.de>,
Jason Gunthorpe <jgg@ziepe.ca>, Nishanth Menon <nm@ti.com>,
Michael Kelley <mikelley@microsoft.com>,
Dan Williams <dan.j.williams@intel.com>,
Won Chung <wonchung@google.com>, David Gow <davidgow@google.com>,
Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Roman Gushchin <roman.gushchin@linux.dev>,
Hyeonggon Yoo <42.hyeyoo@gmail.com>,
Guenter Roeck <linux@roeck-us.net>,
Andy Shevchenko <andriy.shevchenko@intel.com>,
Paolo Abeni <pabeni@redhat.com>,
Geert Uytterhoeven <geert@linux-m68k.org>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Tom Rix <trix@redhat.com>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
linux-hardening@vger.kernel.org, llvm@lists.linux.dev,
Sumit Semwal <sumit.semwal@linaro.org>
Subject: Re: [PATCH 5/6] driver core: Add __alloc_size hint to devm allocators
Date: Thu, 2 Feb 2023 17:18:01 +0000 [thread overview]
Message-ID: <63dbf04a.630a0220.2608a.0149@mx.google.com> (raw)
In-Reply-To: <CANDhNCogJrvt=yEXFK-xVmGjkcRxSNGZUqUeNw2MV9bFRrwPdQ@mail.gmail.com>
On Wed, Feb 01, 2023 at 12:11:41AM -0800, John Stultz wrote:
> On Tue, Jan 31, 2023 at 11:36 PM Yongqin Liu <yongqin.liu@linaro.org> wrote:
> >
> > Hi, Kees
> >
> > This change causes "Kernel panic - not syncing: BRK handler: Fatal exception"
> > for the android-mainline based hikey960 build, with this commit reverted,
> > there is no problem for the build to boot to the homescreen.
> > Not sure if you have any idea about it and give some suggestions.
> >
> > Here is part of the kernel panic log:
> >
> > [ 9.479878][ T122] ueventd: Loading module
> > /vendor/lib/modules/spi-pl022.ko with args ''
> > [ 9.480276][ T115] apexd-bootstrap: Pre-allocated loop device 29
> > [ 9.480517][ T123] ueventd: LoadWithAliases was unable to load
> > of:Nhi3660_i2sT(null)Chisilicon,hi3660-i2s-1.0
> > [ 9.480632][ T121] Unexpected kernel BRK exception at EL1
> > [ 9.480637][ T121] Internal error: BRK handler:
> > 00000000f2000001 [#1] PREEMPT SMP
> > [ 9.480644][ T121] Modules linked in: cpufreq_dt(E+)
> > hisi_thermal(E+) phy_hi3660_usb3(E) btqca(E) hi6421_pmic_core(E)
> > btbcm(E) spi_pl022(E) hi3660_mailbox(E) i2c_designware_platform(E)
> > mali_kbase(OE) dw_mmc_k3(E) bluetooth(E) dw_mmc_pltfm(E) dw_mmc(E)
> > kirin_drm(E) rfkill(E) kirin_dsi(E) i2c_designware_core(E) k3dma(E)
> > drm_dma_helper(E) cma_heap(E) system_heap(E)
> > [ 9.480688][ T121] CPU: 4 PID: 121 Comm: ueventd Tainted: G
> > OE 6.2.0-rc6-mainline-14196-g1d9f94ec75b9 #1
> > [ 9.480694][ T121] Hardware name: HiKey960 (DT)
> > [ 9.480697][ T121] pstate: 20400005 (nzCv daif +PAN -UAO -TCO
> > -DIT -SSBS BTYPE=--)
> > [ 9.480703][ T121] pc : hi3660_thermal_probe+0x6c/0x74 [hisi_thermal]
> > [ 9.480722][ T121] lr : hi3660_thermal_probe+0x38/0x74 [hisi_thermal]
> > [ 9.480733][ T121] sp : ffffffc00aa13700
> > [ 9.480735][ T121] x29: ffffffc00aa13700 x28: 0000007ff8ae8531
> > x27: 00000000000008c0
> > [ 9.480743][ T121] x26: ffffffc00aa2a300 x25: ffffffc00aa2ab40
> > x24: 000000000000001d
> > [ 9.480749][ T121] x23: ffffffc00a29d000 x22: 0000000000000000
> > x21: ffffff8001fa4a80
> > [ 9.480755][ T121] x20: 0000000000000001 x19: ffffff8001fa4a80
> > x18: ffffffc00a8810b0
> > [ 9.480761][ T121] x17: 000000007ab542f2 x16: 000000007ab542f2
> > x15: ffffffc00aa01000
> > [ 9.480767][ T121] x14: ffffffc00966f250 x13: ffffffc0b58f9000
> > x12: ffffffc00a055f10
> > [ 9.480771][ T123] ueventd: LoadWithAliases was unable to load
> > cpu:type:aarch64:feature:,0000,0001,0002,0003,0004,0005,0006,0007,000B
> > [ 9.480773][ T121]
> > [ 9.480774][ T121] x11: 0000000000000000 x10: 0000000000000001
> > x9 : 0000000100000000
> > [ 9.480780][ T123] ueventd:
> > [ 9.480780][ T121] x8 : ffffffc0044154cb x7 : 0000000000000000
> > x6 : 000000000000003f
> > [ 9.480786][ T121] x5 : 0000000000000020 x4 : ffffffc0098db323
> > x3 : ffffff801aeb62c0
> > [ 9.480792][ T121] x2 : ffffff801aeb62c0 x1 : 0000000000000000
> > x0 : ffffff8001fa4c80
> > [ 9.480798][ T121] Call trace:
> > [ 9.480801][ T121] hi3660_thermal_probe+0x6c/0x74 [hisi_thermal]
> > [ 9.480813][ T121] hisi_thermal_probe+0xbc/0x284 [hisi_thermal]
>
>
> Taking a look here, it looks pretty obvious:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/thermal/hisi_thermal.c#n414
>
> data->nr_sensors = 1;
> data->sensor = devm_kzalloc(dev, sizeof(*data->sensor) *
> data->nr_sensors, GFP_KERNEL);
>
> Here as nr_sensors=1, we allocate only one structure for the array.
> But then below that, we modify two entries, writing past the valid
> array, and corrupting data when writing the second sensor values.
>
> data->sensor[0].id = HI3660_BIG_SENSOR;
> data->sensor[0].irq_name = "tsensor_a73";
> data->sensor[0].data = data;
>
> data->sensor[1].id = HI3660_LITTLE_SENSOR;
> data->sensor[1].irq_name = "tsensor_a53";
> data->sensor[1].data = data;
>
> I suspect nr_sensors needs to be set to 2.
>
> Nice work, Kees!
Yay for compilers! :)
Was a patch sent to fix this driver?
--
Kees Cook
next prev parent reply other threads:[~2023-02-02 17:18 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-01 22:33 [PATCH 0/6] slab: Provide full coverage for __alloc_size attribute Kees Cook
2022-11-01 22:33 ` [PATCH 1/6] slab: Clean up SLOB vs kmalloc() definition Kees Cook
2022-11-03 13:32 ` Hyeonggon Yoo
2022-11-01 22:33 ` [PATCH 2/6] slab: Remove special-casing of const 0 size allocations Kees Cook
2022-11-03 14:00 ` Hyeonggon Yoo
2022-11-01 22:33 ` [PATCH 3/6] slab: Provide functional __alloc_size() hints to kmalloc_trace*() Kees Cook
2022-11-03 14:16 ` Hyeonggon Yoo
2022-11-04 18:22 ` Kees Cook
2022-11-05 1:09 ` Hyeonggon Yoo
2022-11-05 6:45 ` Kees Cook
2022-11-01 22:33 ` [PATCH 4/6] string: Add __realloc_size hint to kmemdup() Kees Cook
2022-11-02 9:26 ` Rasmus Villemoes
2022-11-02 19:40 ` Kees Cook
2022-11-01 22:33 ` [PATCH 5/6] driver core: Add __alloc_size hint to devm allocators Kees Cook
2023-02-01 7:36 ` Yongqin Liu
2023-02-01 8:11 ` John Stultz
2023-02-01 8:16 ` John Stultz
2023-02-01 18:41 ` Andy Shevchenko
2023-02-02 17:18 ` Kees Cook [this message]
2023-02-02 18:56 ` John Stultz
2023-02-02 19:10 ` Kees Cook
2023-02-02 19:20 ` Ard Biesheuvel
2023-02-02 19:31 ` Nick Desaulniers
2023-02-02 19:49 ` Sami Tolvanen
2023-02-02 19:53 ` Kees Cook
2023-02-02 20:11 ` Sami Tolvanen
2023-02-02 20:43 ` Kees Cook
2022-11-01 22:33 ` [PATCH 6/6] kunit/fortify: Validate __alloc_size attribute results Kees Cook
2022-11-02 18:15 ` kernel test robot
2022-11-29 12:24 ` [PATCH 0/6] slab: Provide full coverage for __alloc_size attribute Conor Dooley
2022-11-29 12:33 ` Arnd Bergmann
2022-12-01 17:15 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=63dbf04a.630a0220.2608a.0149@mx.google.com \
--to=keescook@chromium.org \
--cc=42.hyeyoo@gmail.com \
--cc=andriy.shevchenko@intel.com \
--cc=cl@linux.com \
--cc=dan.j.williams@intel.com \
--cc=davidgow@google.com \
--cc=geert@linux-m68k.org \
--cc=gregkh@linuxfoundation.org \
--cc=iamjoonsoo.kim@lge.com \
--cc=jgg@ziepe.ca \
--cc=jstultz@google.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux@roeck-us.net \
--cc=llvm@lists.linux.dev \
--cc=mikelley@microsoft.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=nm@ti.com \
--cc=pabeni@redhat.com \
--cc=penberg@kernel.org \
--cc=rasmus.villemoes@prevas.dk \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
--cc=sumit.semwal@linaro.org \
--cc=tglx@linutronix.de \
--cc=trix@redhat.com \
--cc=vbabka@suse.cz \
--cc=wonchung@google.com \
--cc=yongqin.liu@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.