From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: "Paweł Chmiel" <pawel.mikolaj.chmiel@gmail.com>
Cc: robh+dt@kernel.org, mark.rutland@arm.com, xc-racer2@live.ca,
devicetree@vger.kernel.org, linux-input@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 5/5] input: misc: bma150: Register input device after setting private data
Date: Wed, 6 Feb 2019 11:23:31 -0800 [thread overview]
Message-ID: <20190206192331.GE174258@dtor-ws> (raw)
In-Reply-To: <20190206185307.GD174258@dtor-ws>
On Wed, Feb 06, 2019 at 10:53:07AM -0800, Dmitry Torokhov wrote:
> On Sat, Feb 02, 2019 at 04:18:06PM +0100, Paweł Chmiel wrote:
> > From: Jonathan Bakker <xc-racer2@live.ca>
> >
> > Otherwise we introduce a race condition where userspace can request input
> > before we're ready leading to null pointer dereference such as
> >
> > input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
> > Unable to handle kernel NULL pointer dereference at virtual address 00000018
> > pgd = (ptrval)
> > [00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000
> > Internal error: Oops: 17 [#1] PREEMPT ARM
> > Modules linked in: bma150 input_polldev [last unloaded: bma150]
> > CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46
> > Hardware name: Samsung S5PC110/S5PV210-based board
> > PC is at input_event+0x8/0x60
> > LR is at bma150_report_xyz+0x9c/0xe0 [bma150]
> > pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013
> > sp : a4c1fd78 ip : 00000081 fp : 00020000
> > r10: 00000000 r9 : a5e2944c r8 : a7455000
> > r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048
> > r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000
> > Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
> > Control: 10c5387d Table: 54e34019 DAC: 00000051
> > Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
> > Stackck: (0xa4c1fd78 to 0xa4c20000)
> > fd60: fffffff3 fc813f6c
> > fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
> > fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
> > fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
> > fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
> > fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
> > fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
> > fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
> > fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
> > fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
> > fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
> > fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
> > fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
> > ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
> > ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
> > ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
> > ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
> > ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
> > ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
> > ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
> > ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000
> > [<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c)
> > Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018)
> > ---[ end trace 1c691ee85f2ff243 ]---
> >
> > Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
> > Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
>
> Applied, thank you.
Actually I'll move it to the current release and mark for sable.
>
> > ---
> > drivers/input/misc/bma150.c | 15 +++------------
> > 1 file changed, 3 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c
> > index 1cdc8ce97968..64caf43e5bca 100644
> > --- a/drivers/input/misc/bma150.c
> > +++ b/drivers/input/misc/bma150.c
> > @@ -470,7 +470,6 @@ static void bma150_init_input_device(struct bma150_data *bma150,
> > static int bma150_register_input_device(struct bma150_data *bma150)
> > {
> > struct input_dev *idev;
> > - int error;
> >
> > idev = devm_input_allocate_device(&bma150->client->dev);
> > if (!idev)
> > @@ -482,18 +481,14 @@ static int bma150_register_input_device(struct bma150_data *bma150)
> > idev->close = bma150_irq_close;
> > input_set_drvdata(idev, bma150);
> >
> > - error = input_register_device(idev);
> > - if (error)
> > - return error;
> > -
> > bma150->input = idev;
> > - return 0;
> > +
> > + return input_register_device(idev);
> > }
> >
> > static int bma150_register_polled_device(struct bma150_data *bma150)
> > {
> > struct input_polled_dev *ipoll_dev;
> > - int error;
> >
> > ipoll_dev = devm_input_allocate_polled_device(&bma150->client->dev);
> > if (!ipoll_dev)
> > @@ -509,14 +504,10 @@ static int bma150_register_polled_device(struct bma150_data *bma150)
> >
> > bma150_init_input_device(bma150, ipoll_dev->input);
> >
> > - error = input_register_polled_device(ipoll_dev);
> > - if (error)
> > - return error;
> > -
> > bma150->input_polled = ipoll_dev;
> > bma150->input = ipoll_dev->input;
> >
> > - return 0;
> > + return input_register_polled_device(ipoll_dev);
> > }
> >
> > int bma150_cfg_from_of(struct device_node *np)
> > --
> > 2.17.1
> >
>
> --
> Dmitry
--
Dmitry
prev parent reply other threads:[~2019-02-06 19:23 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-02 15:18 [PATCH v2 0/5] input: misc: bma150: Add support for device tree Paweł Chmiel
2019-02-02 15:18 ` [PATCH v2 1/5] dt-bindings: input: Add binding for bma150 sensor Paweł Chmiel
2019-02-18 19:18 ` Rob Herring
2019-02-18 22:17 ` Jonathan Bakker
2019-02-02 15:18 ` [PATCH v2 2/5] input: misc: bma150: Use managed resources helpers Paweł Chmiel
2019-02-06 18:52 ` Dmitry Torokhov
2019-02-02 15:18 ` [PATCH v2 3/5] input: misc: bma150: Add support for device tree Paweł Chmiel
2019-02-02 15:18 ` [PATCH v2 4/5] input: misc: bma150: Drop platform data Paweł Chmiel
2019-02-02 15:18 ` [PATCH v2 5/5] input: misc: bma150: Register input device after setting private data Paweł Chmiel
2019-02-06 18:53 ` Dmitry Torokhov
2019-02-06 19:23 ` Dmitry Torokhov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190206192331.GE174258@dtor-ws \
--to=dmitry.torokhov@gmail.com \
--cc=devicetree@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=pawel.mikolaj.chmiel@gmail.com \
--cc=robh+dt@kernel.org \
--cc=xc-racer2@live.ca \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).