[PATCH] driver core: platform: use the correct callback type for bus_find_device

[PATCH] driver core: platform: use the correct callback type for bus_find_device

[Sami Tolvanen]

platform_find_device_by_driver calls bus_find_device and passes
platform_match as the callback function. Casting the function to a
mismatching type trips indirect call Control-Flow Integrity (CFI) checking.

This change adds a callback function with the correct type and instead
of casting the function, explicitly casts the second parameter to struct
device_driver* as expected by platform_match.

Fixes: 36f3313d6bff9 ("platform: Add platform_find_device_by_driver() helper")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
---
 drivers/base/platform.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index b230beb6ccb4..3c0cd20925b7 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -1278,6 +1278,11 @@ struct bus_type platform_bus_type = {
 };
 EXPORT_SYMBOL_GPL(platform_bus_type);
 
+static inline int __platform_match(struct device *dev, const void *drv)
+{
+	return platform_match(dev, (struct device_driver *)drv);
+}
+
 /**
  * platform_find_device_by_driver - Find a platform device with a given
  * driver.
@@ -1288,7 +1293,7 @@ struct device *platform_find_device_by_driver(struct device *start,
 					      const struct device_driver *drv)
 {
 	return bus_find_device(&platform_bus_type, start, drv,
-			       (void *)platform_match);
+			       __platform_match);
 }
 EXPORT_SYMBOL_GPL(platform_find_device_by_driver);
 

base-commit: 100d46bd72ec689a5582c2f5f4deadc5bcb92d60
-- 
2.24.0.rc1.363.gb1bccd3e3d-goog

Re: [PATCH] driver core: platform: use the correct callback type for bus_find_device

[Kees Cook]

On Tue, Nov 12, 2019 at 01:41:56PM -0800, Sami Tolvanen wrote:
> platform_find_device_by_driver calls bus_find_device and passes
> platform_match as the callback function. Casting the function to a
> mismatching type trips indirect call Control-Flow Integrity (CFI) checking.

Specifically, the mismatch is between these two places:

struct device *bus_find_device(struct bus_type *bus,
                               struct device *start, const void *data,
                               int (*match)(struct device *dev, const void *data))

struct bus_type {
	...
        int (*match)(struct device *dev, struct device_driver *drv);

against the function itself, which needs to match the prototype for the
initializer assignment:

static int platform_match(struct device *dev, struct device_driver *drv)

I'm surprised this is the only place in the kernel where this happens,
but a grep for other bus_find_device() users shows that they don't also
have struct bus_type helpers; everything else uses the "const void
*data" second argument.

> This change adds a callback function with the correct type and instead
> of casting the function, explicitly casts the second parameter to struct
> device_driver* as expected by platform_match.
> 
> Fixes: 36f3313d6bff9 ("platform: Add platform_find_device_by_driver() helper")
> Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
> ---
>  drivers/base/platform.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index b230beb6ccb4..3c0cd20925b7 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -1278,6 +1278,11 @@ struct bus_type platform_bus_type = {
>  };
>  EXPORT_SYMBOL_GPL(platform_bus_type);
>  
> +static inline int __platform_match(struct device *dev, const void *drv)
> +{
> +	return platform_match(dev, (struct device_driver *)drv);
> +}
> +

So, this makes sense to me. :)

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

>  /**
>   * platform_find_device_by_driver - Find a platform device with a given
>   * driver.
> @@ -1288,7 +1293,7 @@ struct device *platform_find_device_by_driver(struct device *start,
>  					      const struct device_driver *drv)
>  {
>  	return bus_find_device(&platform_bus_type, start, drv,
> -			       (void *)platform_match);
> +			       __platform_match);
>  }
>  EXPORT_SYMBOL_GPL(platform_find_device_by_driver);
>  
> 
> base-commit: 100d46bd72ec689a5582c2f5f4deadc5bcb92d60
> -- 
> 2.24.0.rc1.363.gb1bccd3e3d-goog
> 

-- 
Kees Cook