From: Cristian Marussi <cristian.marussi@arm.com>
To: Sudeep Holla <sudeep.holla@arm.com>
Cc: Viresh Kumar <viresh.kumar@linaro.org>,
linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free
Date: Tue, 8 Sep 2020 16:24:22 +0100 [thread overview]
Message-ID: <20200908152422.GA13913@e119603-lin.cambridge.arm.com> (raw)
In-Reply-To: <20200908112611.31515-1-sudeep.holla@arm.com>
On Tue, Sep 08, 2020 at 12:26:11PM +0100, Sudeep Holla wrote:
> scmi_mailbox is obtained from cinfo->transport_info and the first
> call to mailbox_chan_free frees the channel and sets cinfo->transport_info
> to NULL. Care is taken to check for non NULL smbox->chan but smbox can
> itself be NULL. Fix it by checking for it without which, kernel crashes
> with below NULL pointer dereference and eventually kernel panic.
>
LGTM.
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Tested-by: Cristian Marussi <cristian.marussi@arm.com>
Cheers
Cristian
> Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000038
> Modules linked in: scmi_module(-)
> Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno
> Development Platform, BIOS EDK II Sep 2 2020
> pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
> pc : mailbox_chan_free+0x2c/0x70 [scmi_module]
> lr : idr_for_each+0x6c/0xf8
> Call trace:
> mailbox_chan_free+0x2c/0x70 [scmi_module]
> idr_for_each+0x6c/0xf8
> scmi_remove+0xa8/0xf0 [scmi_module]
> platform_drv_remove+0x34/0x58
> device_release_driver_internal+0x118/0x1f0
> driver_detach+0x58/0xe8
> bus_remove_driver+0x64/0xe0
> driver_unregister+0x38/0x68
> platform_driver_unregister+0x1c/0x28
> scmi_driver_exit+0x38/0x44 [scmi_module]
> ---[ end trace 17bde19f50436de9 ]---
> Kernel panic - not syncing: Fatal exception
> SMP: stopping secondary CPUs
> Kernel Offset: 0x1d0000 from 0xffff800010000000
> PHYS_OFFSET: 0x80000000
> CPU features: 0x0240022,25806004
> Memory Limit: none
> ---[ end Kernel panic - not syncing: Fatal exception ]---
>
> Cc: Cristian Marussi <cristian.marussi@arm.com>
> Cc: Viresh Kumar <viresh.kumar@linaro.org>
> Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
> ---
> drivers/firmware/arm_scmi/mailbox.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c
> index cc2de207fe10..4626404be541 100644
> --- a/drivers/firmware/arm_scmi/mailbox.c
> +++ b/drivers/firmware/arm_scmi/mailbox.c
> @@ -110,7 +110,7 @@ static int mailbox_chan_free(int id, void *p, void *data)
> struct scmi_chan_info *cinfo = p;
> struct scmi_mailbox *smbox = cinfo->transport_info;
>
> - if (!IS_ERR(smbox->chan)) {
> + if (smbox && !IS_ERR(smbox->chan)) {
> mbox_free_channel(smbox->chan);
> cinfo->transport_info = NULL;
> smbox->chan = NULL;
> --
> 2.17.1
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-09-08 15:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-08 11:26 [PATCH] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free Sudeep Holla
2020-09-08 15:24 ` Cristian Marussi [this message]
2020-09-09 3:47 ` Viresh Kumar
2020-09-14 6:34 ` Sudeep Holla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200908152422.GA13913@e119603-lin.cambridge.arm.com \
--to=cristian.marussi@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=sudeep.holla@arm.com \
--cc=viresh.kumar@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox