* [PATCH V2] nvmem: core: fix memory abort in cleanup path
@ 2020-01-03 12:56 Bitan Biswas
2020-01-06 11:48 ` Srinivas Kandagatla
0 siblings, 1 reply; 2+ messages in thread
From: Bitan Biswas @ 2020-01-03 12:56 UTC (permalink / raw)
To: Srinivas Kandagatla, Greg Kroah-Hartman, Rob Herring,
linux-kernel
Cc: Thierry Reding, Jonathan Hunter, Bitan Biswas
nvmem_cell_info_to_nvmem_cell implementation has static
allocation of name. nvmem_add_cells_from_of() call may
return error and kfree name results in memory abort. Use
kstrdup_const() and kfree_const calls for name alloc and free.
[ 8.076461] Unable to handle kernel paging request at virtual address ffffffffffe44888
[ 8.084762] Mem abort info:
[ 8.087694] ESR = 0x96000006
[ 8.090906] EC = 0x25: DABT (current EL), IL = 32 bits
[ 8.096476] SET = 0, FnV = 0
[ 8.099683] EA = 0, S1PTW = 0
[ 8.102976] Data abort info:
[ 8.106004] ISV = 0, ISS = 0x00000006
[ 8.110026] CM = 0, WnR = 0
[ 8.113154] swapper pgtable: 64k pages, 48-bit VAs, pgdp=00000000815d0000
[ 8.120279] [ffffffffffe44888] pgd=0000000081d30803, pud=0000000081d30803, pmd=0000000000000000
[ 8.129429] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 8.135257] Modules linked in:
[ 8.138456] CPU: 2 PID: 43 Comm: kworker/2:1 Tainted: G S 5.5.0-rc3-tegra-00051-g6989dd3-dirty #3 [ 8.149098] Hardware name: quill (DT)
[ 8.152968] Workqueue: events deferred_probe_work_func
[ 8.158350] pstate: a0000005 (NzCv daif -PAN -UAO)
[ 8.163386] pc : kfree+0x38/0x278
[ 8.166873] lr : nvmem_cell_drop+0x68/0x80
[ 8.171154] sp : ffff80001284f9d0
[ 8.174620] x29: ffff80001284f9d0 x28: ffff0001f677e830
[ 8.180189] x27: ffff800011b0b000 x26: ffff0001c36e1008
[ 8.185755] x25: ffff8000112ad000 x24: ffff8000112c9000
[ 8.191311] x23: ffffffffffffffea x22: ffff800010adc7f0
[ 8.196865] x21: ffffffffffe44880 x20: ffff800011b0b068
[ 8.202424] x19: ffff80001122d380 x18: ffffffffffffffff
[ 8.207987] x17: 00000000d5cb4756 x16: 0000000070b193b8
[ 8.213550] x15: ffff8000119538c8 x14: 0720072007200720
[ 8.219120] x13: 07200720076e0772 x12: 07750762072d0765
[ 8.224685] x11: 0773077507660765 x10: 072f073007300730
[ 8.230253] x9 : 0730073207380733 x8 : 0000000000000151
[ 8.235818] x7 : 07660765072f0720 x6 : ffff0001c00e0f00
[ 8.241382] x5 : 0000000000000000 x4 : ffff0001c0b43800
[ 8.247007] x3 : ffff800011b0b068 x2 : 0000000000000000
[ 8.252567] x1 : 0000000000000000 x0 : ffffffdfffe00000
[ 8.258126] Call trace:
[ 8.260705] kfree+0x38/0x278
[ 8.263827] nvmem_cell_drop+0x68/0x80
[ 8.267773] nvmem_device_remove_all_cells+0x2c/0x50
[ 8.272988] nvmem_register.part.9+0x520/0x628
[ 8.277655] devm_nvmem_register+0x48/0xa0
[ 8.281966] tegra_fuse_probe+0x140/0x1f0
[ 8.286181] platform_drv_probe+0x50/0xa0
[ 8.290397] really_probe+0x108/0x348
[ 8.294243] driver_probe_device+0x58/0x100
[ 8.298618] __device_attach_driver+0x90/0xb0
[ 8.303172] bus_for_each_drv+0x64/0xc8
[ 8.307184] __device_attach+0xd8/0x138
[ 8.311195] device_initial_probe+0x10/0x18
[ 8.315562] bus_probe_device+0x90/0x98
[ 8.319572] deferred_probe_work_func+0x74/0xb0
[ 8.324304] process_one_work+0x1e0/0x358
[ 8.328490] worker_thread+0x208/0x488
[ 8.332411] kthread+0x118/0x120
[ 8.335783] ret_from_fork+0x10/0x18
[ 8.339561] Code: d350feb5 f2dffbe0 aa1e03f6 8b151815 (f94006a0)
[ 8.345939] ---[ end trace 49b1303c6b83198e ]---
Fixes: badcdff107cbf ("nvmem: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Bitan Biswas <bbiswas@nvidia.com>
---
drivers/nvmem/core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 9f1ee9c..1e4a798 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -83,7 +83,7 @@ static void nvmem_cell_drop(struct nvmem_cell *cell)
list_del(&cell->node);
mutex_unlock(&nvmem_mutex);
of_node_put(cell->np);
- kfree(cell->name);
+ kfree_const(cell->name);
kfree(cell);
}
@@ -110,7 +110,9 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
cell->nvmem = nvmem;
cell->offset = info->offset;
cell->bytes = info->bytes;
- cell->name = info->name;
+ cell->name = kstrdup_const(info->name, GFP_KERNEL);
+ if (!cell->name)
+ return -ENOMEM;
cell->bit_offset = info->bit_offset;
cell->nbits = info->nbits;
@@ -300,7 +302,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
dev_err(dev, "cell %s unaligned to nvmem stride %d\n",
cell->name, nvmem->stride);
/* Cells already added will be freed later. */
- kfree(cell->name);
+ kfree_const(cell->name);
kfree(cell);
return -EINVAL;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH V2] nvmem: core: fix memory abort in cleanup path
2020-01-03 12:56 [PATCH V2] nvmem: core: fix memory abort in cleanup path Bitan Biswas
@ 2020-01-06 11:48 ` Srinivas Kandagatla
0 siblings, 0 replies; 2+ messages in thread
From: Srinivas Kandagatla @ 2020-01-06 11:48 UTC (permalink / raw)
To: Bitan Biswas, Greg Kroah-Hartman, Rob Herring, linux-kernel
Cc: Thierry Reding, Jonathan Hunter
On 03/01/2020 12:56, Bitan Biswas wrote:
> nvmem_cell_info_to_nvmem_cell implementation has static
> allocation of name. nvmem_add_cells_from_of() call may
> return error and kfree name results in memory abort. Use
> kstrdup_const() and kfree_const calls for name alloc and free.
>
> [ 8.076461] Unable to handle kernel paging request at virtual address ffffffffffe44888
> [ 8.084762] Mem abort info:
> [ 8.087694] ESR = 0x96000006
> [ 8.090906] EC = 0x25: DABT (current EL), IL = 32 bits
> [ 8.096476] SET = 0, FnV = 0
> [ 8.099683] EA = 0, S1PTW = 0
> [ 8.102976] Data abort info:
> [ 8.106004] ISV = 0, ISS = 0x00000006
> [ 8.110026] CM = 0, WnR = 0
> [ 8.113154] swapper pgtable: 64k pages, 48-bit VAs, pgdp=00000000815d0000
> [ 8.120279] [ffffffffffe44888] pgd=0000000081d30803, pud=0000000081d30803, pmd=0000000000000000
> [ 8.129429] Internal error: Oops: 96000006 [#1] PREEMPT SMP
> [ 8.135257] Modules linked in:
> [ 8.138456] CPU: 2 PID: 43 Comm: kworker/2:1 Tainted: G S 5.5.0-rc3-tegra-00051-g6989dd3-dirty #3 [ 8.149098] Hardware name: quill (DT)
> [ 8.152968] Workqueue: events deferred_probe_work_func
> [ 8.158350] pstate: a0000005 (NzCv daif -PAN -UAO)
> [ 8.163386] pc : kfree+0x38/0x278
> [ 8.166873] lr : nvmem_cell_drop+0x68/0x80
> [ 8.171154] sp : ffff80001284f9d0
> [ 8.174620] x29: ffff80001284f9d0 x28: ffff0001f677e830
> [ 8.180189] x27: ffff800011b0b000 x26: ffff0001c36e1008
> [ 8.185755] x25: ffff8000112ad000 x24: ffff8000112c9000
> [ 8.191311] x23: ffffffffffffffea x22: ffff800010adc7f0
> [ 8.196865] x21: ffffffffffe44880 x20: ffff800011b0b068
> [ 8.202424] x19: ffff80001122d380 x18: ffffffffffffffff
> [ 8.207987] x17: 00000000d5cb4756 x16: 0000000070b193b8
> [ 8.213550] x15: ffff8000119538c8 x14: 0720072007200720
> [ 8.219120] x13: 07200720076e0772 x12: 07750762072d0765
> [ 8.224685] x11: 0773077507660765 x10: 072f073007300730
> [ 8.230253] x9 : 0730073207380733 x8 : 0000000000000151
> [ 8.235818] x7 : 07660765072f0720 x6 : ffff0001c00e0f00
> [ 8.241382] x5 : 0000000000000000 x4 : ffff0001c0b43800
> [ 8.247007] x3 : ffff800011b0b068 x2 : 0000000000000000
> [ 8.252567] x1 : 0000000000000000 x0 : ffffffdfffe00000
> [ 8.258126] Call trace:
> [ 8.260705] kfree+0x38/0x278
> [ 8.263827] nvmem_cell_drop+0x68/0x80
> [ 8.267773] nvmem_device_remove_all_cells+0x2c/0x50
> [ 8.272988] nvmem_register.part.9+0x520/0x628
> [ 8.277655] devm_nvmem_register+0x48/0xa0
> [ 8.281966] tegra_fuse_probe+0x140/0x1f0
> [ 8.286181] platform_drv_probe+0x50/0xa0
> [ 8.290397] really_probe+0x108/0x348
> [ 8.294243] driver_probe_device+0x58/0x100
> [ 8.298618] __device_attach_driver+0x90/0xb0
> [ 8.303172] bus_for_each_drv+0x64/0xc8
> [ 8.307184] __device_attach+0xd8/0x138
> [ 8.311195] device_initial_probe+0x10/0x18
> [ 8.315562] bus_probe_device+0x90/0x98
> [ 8.319572] deferred_probe_work_func+0x74/0xb0
> [ 8.324304] process_one_work+0x1e0/0x358
> [ 8.328490] worker_thread+0x208/0x488
> [ 8.332411] kthread+0x118/0x120
> [ 8.335783] ret_from_fork+0x10/0x18
> [ 8.339561] Code: d350feb5 f2dffbe0 aa1e03f6 8b151815 (f94006a0)
> [ 8.345939] ---[ end trace 49b1303c6b83198e ]---
>
> Fixes: badcdff107cbf ("nvmem: Convert to using %pOFn instead of device_node.name")
>
> Signed-off-by: Bitan Biswas <bbiswas@nvidia.com>
> ---
> drivers/nvmem/core.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
Applied Thanks,
--srini
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-01-06 11:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-01-03 12:56 [PATCH V2] nvmem: core: fix memory abort in cleanup path Bitan Biswas
2020-01-06 11:48 ` Srinivas Kandagatla
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox