From: Viresh Kumar <viresh.kumar@linaro.org>
To: Sudeep Holla <sudeep.holla@arm.com>
Cc: Cristian Marussi <cristian.marussi@arm.com>,
linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free
Date: Wed, 9 Sep 2020 09:17:32 +0530 [thread overview]
Message-ID: <20200909034732.wlpc62hwodozwsuf@vireshk-i7> (raw)
In-Reply-To: <20200908112611.31515-1-sudeep.holla@arm.com>
On 08-09-20, 12:26, Sudeep Holla wrote:
> scmi_mailbox is obtained from cinfo->transport_info and the first
> call to mailbox_chan_free frees the channel and sets cinfo->transport_info
> to NULL. Care is taken to check for non NULL smbox->chan but smbox can
> itself be NULL. Fix it by checking for it without which, kernel crashes
> with below NULL pointer dereference and eventually kernel panic.
>
> Unable to handle kernel NULL pointer dereference at
> virtual address 0000000000000038
> Modules linked in: scmi_module(-)
> Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno
> Development Platform, BIOS EDK II Sep 2 2020
> pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
> pc : mailbox_chan_free+0x2c/0x70 [scmi_module]
> lr : idr_for_each+0x6c/0xf8
> Call trace:
> mailbox_chan_free+0x2c/0x70 [scmi_module]
> idr_for_each+0x6c/0xf8
> scmi_remove+0xa8/0xf0 [scmi_module]
> platform_drv_remove+0x34/0x58
> device_release_driver_internal+0x118/0x1f0
> driver_detach+0x58/0xe8
> bus_remove_driver+0x64/0xe0
> driver_unregister+0x38/0x68
> platform_driver_unregister+0x1c/0x28
> scmi_driver_exit+0x38/0x44 [scmi_module]
> ---[ end trace 17bde19f50436de9 ]---
> Kernel panic - not syncing: Fatal exception
> SMP: stopping secondary CPUs
> Kernel Offset: 0x1d0000 from 0xffff800010000000
> PHYS_OFFSET: 0x80000000
> CPU features: 0x0240022,25806004
> Memory Limit: none
> ---[ end Kernel panic - not syncing: Fatal exception ]---
>
> Cc: Cristian Marussi <cristian.marussi@arm.com>
> Cc: Viresh Kumar <viresh.kumar@linaro.org>
> Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
> ---
> drivers/firmware/arm_scmi/mailbox.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
--
viresh
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-09-09 3:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-08 11:26 [PATCH] firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free Sudeep Holla
2020-09-08 15:24 ` Cristian Marussi
2020-09-09 3:47 ` Viresh Kumar [this message]
2020-09-14 6:34 ` Sudeep Holla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200909034732.wlpc62hwodozwsuf@vireshk-i7 \
--to=viresh.kumar@linaro.org \
--cc=cristian.marussi@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=sudeep.holla@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox