public inbox for linux-iio@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v1] counter: fix NULL pointer dereference on counter_comp_u8_store()
@ 2022-02-03 13:54 Oleksij Rempel
  2022-02-04  7:02 ` William Breathitt Gray
  0 siblings, 1 reply; 11+ messages in thread
From: Oleksij Rempel @ 2022-02-03 13:54 UTC (permalink / raw)
  To: William Breathitt Gray
  Cc: Oleksij Rempel, linux-kernel, Pengutronix Kernel Team,
	David Jander, Robin van der Gracht, linux-iio, Jonathan Cameron

Current kernel will report NULL pointer dereference with following
back trace:
  interrupt_cnt_enable_write from counter_comp_u8_store+0xc0/0xf4
  counter_comp_u8_store from dev_attr_store+0x24/0x30
  dev_attr_store from sysfs_kf_write+0x48/0x54
  sysfs_kf_write from kernfs_fop_write_iter+0x128/0x1c8
  kernfs_fop_write_iter from vfs_write+0x124/0x1b4
  vfs_write from ksys_write+0x88/0xe0
  ksys_write from sys_write+0x18/0x1c
  sys_write from ret_fast_syscall+0x0/0x1c

Add missing dev_set_drvdata() to fix it.

Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
---
 drivers/counter/counter-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/counter/counter-core.c b/drivers/counter/counter-core.c
index 7e0957eea094..1de16d5e9fbc 100644
--- a/drivers/counter/counter-core.c
+++ b/drivers/counter/counter-core.c
@@ -98,6 +98,8 @@ struct counter_device *counter_alloc(size_t sizeof_priv)
 	counter = &ch->counter;
 	dev = &counter->dev;
 
+	dev_set_drvdata(dev, counter);
+
 	/* Acquire unique ID */
 	err = ida_alloc(&counter_ida, GFP_KERNEL);
 	if (err < 0)
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 11+ messages in thread
* [PATCH] counter: Stop using dev_get_drvdata() to get the counter device
@ 2022-02-18  9:20 William Breathitt Gray
  2022-02-18 10:07 ` Uwe Kleine-König
  0 siblings, 1 reply; 11+ messages in thread
From: William Breathitt Gray @ 2022-02-18  9:20 UTC (permalink / raw)
  To: gregkh
  Cc: linux-iio, Uwe Kleine-König, Oleksij Rempel, Jarkko Nikula,
	William Breathitt Gray

From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

dev_get_drvdata() returns NULL since commit b56346ddbd82 ("counter: Use
container_of instead of drvdata to track counter_device") which wrongly
claimed there were no users of drvdata. Convert to container_of() to
fix a null pointer dereference.

Reported-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes: b56346ddbd82 ("counter: Use container_of instead of drvdata to track counter_device")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Tested-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
---
 drivers/counter/counter-sysfs.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/counter/counter-sysfs.c b/drivers/counter/counter-sysfs.c
index 7cc4d1d523ea..04eac41dad33 100644
--- a/drivers/counter/counter-sysfs.c
+++ b/drivers/counter/counter-sysfs.c
@@ -19,6 +19,11 @@
 
 #include "counter-sysfs.h"
 
+static inline struct counter_device *counter_from_dev(struct device *dev)
+{
+	return container_of(dev, struct counter_device, dev);
+}
+
 /**
  * struct counter_attribute - Counter sysfs attribute
  * @dev_attr:	device attribute for sysfs
@@ -90,7 +95,7 @@ static ssize_t counter_comp_u8_show(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u8 data = 0;
 
@@ -122,7 +127,7 @@ static ssize_t counter_comp_u8_store(struct device *dev,
 				     const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	bool bool_data = 0;
 	u8 data = 0;
@@ -158,7 +163,7 @@ static ssize_t counter_comp_u32_show(struct device *dev,
 				     struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	const struct counter_available *const avail = a->comp.priv;
 	int err;
 	u32 data = 0;
@@ -221,7 +226,7 @@ static ssize_t counter_comp_u32_store(struct device *dev,
 				      const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	struct counter_count *const count = a->parent;
 	struct counter_synapse *const synapse = a->comp.priv;
 	const struct counter_available *const avail = a->comp.priv;
@@ -281,7 +286,7 @@ static ssize_t counter_comp_u64_show(struct device *dev,
 				     struct device_attribute *attr, char *buf)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u64 data = 0;
 
@@ -309,7 +314,7 @@ static ssize_t counter_comp_u64_store(struct device *dev,
 				      const char *buf, size_t len)
 {
 	const struct counter_attribute *const a = to_counter_attribute(attr);
-	struct counter_device *const counter = dev_get_drvdata(dev);
+	struct counter_device *const counter = counter_from_dev(dev);
 	int err;
 	u64 data = 0;
 

base-commit: e6cb9c167eeb8f90ab924666c573e69e85e700a0
-- 
2.35.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2022-02-18 10:07 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-03 13:54 [PATCH v1] counter: fix NULL pointer dereference on counter_comp_u8_store() Oleksij Rempel
2022-02-04  7:02 ` William Breathitt Gray
2022-02-04  8:25   ` [PATCH] counter: Stop using dev_get_drvdata() to get the counter device Uwe Kleine-König
2022-02-08  1:42     ` William Breathitt Gray
2022-02-17 14:48       ` Jarkko Nikula
2022-02-17 16:03         ` Uwe Kleine-König
2022-02-17 23:42           ` William Breathitt Gray
2022-02-18  7:47             ` Uwe Kleine-König
2022-02-18  9:11               ` William Breathitt Gray
  -- strict thread matches above, loose matches on Subject: below --
2022-02-18  9:20 William Breathitt Gray
2022-02-18 10:07 ` Uwe Kleine-König

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox