dmaengine: k3dma: KASAN null-ptr-deref in k3_dma_int_handler() on early IRQ

dmaengine: k3dma: KASAN null-ptr-deref in k3_dma_int_handler() on early IRQ

[Jaeyoung Chung]

Hi,

k3_dma_probe() in drivers/dma/k3dma.c registers the interrupt handler
with devm_request_irq() before it initializes d->phy. If an interrupt
arrives before d->phy is initialized, k3_dma_int_handler() dereferences
a NULL d->phy, causing a kernel panic.

The probe path, in k3_dma_probe():

    d = devm_kzalloc(&op->dev, sizeof(*d), GFP_KERNEL); /* d->phy == NULL */
    ...
    ret = devm_request_irq(&op->dev, irq,
                           k3_dma_int_handler, 0, DRIVER_NAME, d); /* register handler */
    ...
    d->phy = devm_kcalloc(&op->dev,
                          d->dma_channels, sizeof(struct k3_dma_phy), GFP_KERNEL); /* initialize d->phy */

The interrupt handler, k3_dma_int_handler(), dereferences d->phy without
check:

    p = &d->phy[i];
    c = p->vchan;   /* NULL pointer dereference */

If the device raises an interrupt before d->phy is initialized, the
handler dereferences the NULL d->phy, triggering a KASAN
null-ptr-deref.

Suggested fix: move the d->phy = devm_kcalloc() assignment above
devm_request_irq(), so the d->phy array is valid before the
handler can run.

Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>

Thanks,
Jaeyoung Chung

Re: dmaengine: k3dma: KASAN null-ptr-deref in k3_dma_int_handler() on early IRQ

[Vinod Koul]

On 10-06-26, 19:47, Jaeyoung Chung wrote:
> Hi,
> 
> k3_dma_probe() in drivers/dma/k3dma.c registers the interrupt handler
> with devm_request_irq() before it initializes d->phy. If an interrupt
> arrives before d->phy is initialized, k3_dma_int_handler() dereferences
> a NULL d->phy, causing a kernel panic.
> 
> The probe path, in k3_dma_probe():
> 
>     d = devm_kzalloc(&op->dev, sizeof(*d), GFP_KERNEL); /* d->phy == NULL */
>     ...
>     ret = devm_request_irq(&op->dev, irq,
>                            k3_dma_int_handler, 0, DRIVER_NAME, d); /* register handler */
>     ...
>     d->phy = devm_kcalloc(&op->dev,
>                           d->dma_channels, sizeof(struct k3_dma_phy), GFP_KERNEL); /* initialize d->phy */
> 
> The interrupt handler, k3_dma_int_handler(), dereferences d->phy without
> check:
> 
>     p = &d->phy[i];
>     c = p->vchan;   /* NULL pointer dereference */
> 
> If the device raises an interrupt before d->phy is initialized, the
> handler dereferences the NULL d->phy, triggering a KASAN
> null-ptr-deref.
> 
> Suggested fix: move the d->phy = devm_kcalloc() assignment above
> devm_request_irq(), so the d->phy array is valid before the
> handler can run.

Please send a patch

> 
> Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
> Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
> 
> Thanks,
> Jaeyoung Chung

-- 
~Vinod