* [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()
@ 2022-09-28 4:09 Wei Yongjun
2022-09-30 7:48 ` Sa, Nuno
2022-10-02 13:27 ` Jonathan Cameron
0 siblings, 2 replies; 4+ messages in thread
From: Wei Yongjun @ 2022-09-28 4:09 UTC (permalink / raw)
To: Lars-Peter Clausen, Michael Hennerich, Jonathan Cameron,
Ciprian Regus
Cc: Wei Yongjun, linux-iio
From: Wei Yongjun <weiyongjun1@huawei.com>
KASAN report null-ptr-deref as follows:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
Call Trace:
<TASK>
ltc2496_probe+0xf4/0x150
spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
call_driver_probe drivers/base/dd.c:560 [inline]
really_probe+0x207/0x750 drivers/base/dd.c:639
__driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
This happend when probe ltc2496 device with spi device id but without
dts, device_get_match_data() return null chip_info. Fix it by adding
null check for chip_info in ltc2496_probe().
Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c
index 2593fa4322eb..a7353c3dd006 100644
--- a/drivers/iio/adc/ltc2496.c
+++ b/drivers/iio/adc/ltc2496.c
@@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi)
st->spi = spi;
st->common_ddata.result_and_measure = ltc2496_result_and_measure;
st->common_ddata.chip_info = device_get_match_data(dev);
+ if (!st->common_ddata.chip_info)
+ return -ENODEV;
return ltc2497core_probe(dev, indio_dev);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* RE: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()
2022-09-28 4:09 [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe() Wei Yongjun
@ 2022-09-30 7:48 ` Sa, Nuno
2022-10-02 13:27 ` Jonathan Cameron
1 sibling, 0 replies; 4+ messages in thread
From: Sa, Nuno @ 2022-09-30 7:48 UTC (permalink / raw)
To: Wei Yongjun, Lars-Peter Clausen, Hennerich, Michael,
Jonathan Cameron, Regus, Ciprian
Cc: Wei Yongjun, linux-iio@vger.kernel.org
> -----Original Message-----
> From: Wei Yongjun <weiyongjun@huaweicloud.com>
> Sent: Wednesday, September 28, 2022 6:10 AM
> To: Lars-Peter Clausen <lars@metafoo.de>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> Regus, Ciprian <Ciprian.Regus@analog.com>
> Cc: Wei Yongjun <weiyongjun1@huawei.com>; linux-iio@vger.kernel.org
> Subject: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in
> ltc2496_probe()
>
> [External]
>
> From: Wei Yongjun <weiyongjun1@huawei.com>
>
> KASAN report null-ptr-deref as follows:
>
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1
> 04/01/2014
> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
> Call Trace:
> <TASK>
> ltc2496_probe+0xf4/0x150
> spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
> call_driver_probe drivers/base/dd.c:560 [inline]
> really_probe+0x207/0x750 drivers/base/dd.c:639
> __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
> device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
>
> This happend when probe ltc2496 device with spi device id but without
> dts, device_get_match_data() return null chip_info. Fix it by adding
> null check for chip_info in ltc2496_probe().
>
> Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio
> device")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
>
Thanks!
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()
2022-09-28 4:09 [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe() Wei Yongjun
2022-09-30 7:48 ` Sa, Nuno
@ 2022-10-02 13:27 ` Jonathan Cameron
2022-10-08 2:06 ` Wei Yongjun
1 sibling, 1 reply; 4+ messages in thread
From: Jonathan Cameron @ 2022-10-02 13:27 UTC (permalink / raw)
To: Wei Yongjun
Cc: Lars-Peter Clausen, Michael Hennerich, Ciprian Regus, Wei Yongjun,
linux-iio
On Wed, 28 Sep 2022 04:09:48 +0000
Wei Yongjun <weiyongjun@huaweicloud.com> wrote:
> From: Wei Yongjun <weiyongjun1@huawei.com>
>
> KASAN report null-ptr-deref as follows:
>
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
> Call Trace:
> <TASK>
> ltc2496_probe+0xf4/0x150
> spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
> call_driver_probe drivers/base/dd.c:560 [inline]
> really_probe+0x207/0x750 drivers/base/dd.c:639
> __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
> device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
>
> This happend when probe ltc2496 device with spi device id but without
> dts, device_get_match_data() return null chip_info. Fix it by adding
> null check for chip_info in ltc2496_probe().
What tree are you based on? When I look at this file I'm not seeing a
spi_device_id table so how is it matching?
Also I'd prefer a more comprehensive fix that ensured the same data is
available via the spi_device_id table and uses that if
device_get_match_data() == NULL.
Jonathan
>
> Fixes: 1695c52a1260 ("drivers: iio: adc: ltc2497: Rename the LTC2499 iio device")
> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
>
> diff --git a/drivers/iio/adc/ltc2496.c b/drivers/iio/adc/ltc2496.c
> index 2593fa4322eb..a7353c3dd006 100644
> --- a/drivers/iio/adc/ltc2496.c
> +++ b/drivers/iio/adc/ltc2496.c
> @@ -76,6 +76,8 @@ static int ltc2496_probe(struct spi_device *spi)
> st->spi = spi;
> st->common_ddata.result_and_measure = ltc2496_result_and_measure;
> st->common_ddata.chip_info = device_get_match_data(dev);
> + if (!st->common_ddata.chip_info)
> + return -ENODEV;
>
> return ltc2497core_probe(dev, indio_dev);
> }
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe()
2022-10-02 13:27 ` Jonathan Cameron
@ 2022-10-08 2:06 ` Wei Yongjun
0 siblings, 0 replies; 4+ messages in thread
From: Wei Yongjun @ 2022-10-08 2:06 UTC (permalink / raw)
To: Jonathan Cameron, Wei Yongjun
Cc: Lars-Peter Clausen, Michael Hennerich, Ciprian Regus, linux-iio
Hi Jonathan,
On 2022/10/2 21:27, Jonathan Cameron wrote:
> On Wed, 28 Sep 2022 04:09:48 +0000
> Wei Yongjun <weiyongjun@huaweicloud.com> wrote:
>
>> From: Wei Yongjun <weiyongjun1@huawei.com>
>>
>> KASAN report null-ptr-deref as follows:
>>
>> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
>> CPU: 0 PID: 282 Comm: python3 Tainted: G N 6.0.0-rc7-next-20220927+ #153
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>> RIP: 0010:ltc2497core_probe+0x77/0x440 [ltc2497_core]
>> Call Trace:
>> <TASK>
>> ltc2496_probe+0xf4/0x150
>> spi_probe+0x158/0x1f0 drivers/spi/spi.c:421
>> call_driver_probe drivers/base/dd.c:560 [inline]
>> really_probe+0x207/0x750 drivers/base/dd.c:639
>> __driver_probe_device+0x229/0x2a0 drivers/base/dd.c:778
>> device_driver_attach+0xb8/0x1e0 drivers/base/dd.c:1105
>>
>> This happend when probe ltc2496 device with spi device id but without
>> dts, device_get_match_data() return null chip_info. Fix it by adding
>> null check for chip_info in ltc2496_probe().
>
> What tree are you based on? When I look at this file I'm not seeing a
> spi_device_id table so how is it matching?
>
When no spi_device_id tables exists, the driver name in ltc2496_driver
can be used as the spi_device_id for matching.
> Also I'd prefer a more comprehensive fix that ensured the same data is
> available via the spi_device_id table and uses that if
> device_get_match_data() == NULL.
>
Got it, will fix in next version.
Regards,
Wei Yongjun
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-10-08 2:06 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-09-28 4:09 [PATCH] iio: adc: ltc2496: Fix possible null-ptr-deref in ltc2496_probe() Wei Yongjun
2022-09-30 7:48 ` Sa, Nuno
2022-10-02 13:27 ` Jonathan Cameron
2022-10-08 2:06 ` Wei Yongjun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox