From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wj0-f193.google.com ([209.85.210.193]:36425 "EHLO mail-wj0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750761AbdAWOXi (ORCPT ); Mon, 23 Jan 2017 09:23:38 -0500 Received: by mail-wj0-f193.google.com with SMTP id kq3so2017905wjc.3 for ; Mon, 23 Jan 2017 06:23:37 -0800 (PST) From: Rui Miguel Silva To: Greg Kroah-Hartman , Bryan O'Donoghue Cc: Johan Hovold , Alex Elder , devel@driverdev.osuosl.org, greybus-dev@lists.linaro.org, Rui Miguel Silva , "# 4 . 9 . x" Subject: [PATCH] staging: greybus: timesync: validate platform state callback Date: Mon, 23 Jan 2017 14:22:44 +0000 Message-Id: <20170123142244.7468-1-rmfrfs@gmail.com> Sender: stable-owner@vger.kernel.org List-ID: When tearingdown timesync, and not in arche platform, the state platform callback is not initialized. That will trigger the following NULL dereferencing. CallTrace: ? gb_timesync_platform_unlock_bus+0x11/0x20 [greybus] gb_timesync_teardown+0x85/0xc0 [greybus] gb_timesync_svc_remove+0xab/0x190 [greybus] gb_svc_del+0x29/0x110 [greybus] gb_hd_del+0x14/0x20 [greybus] ap_disconnect+0x24/0x60 [gb_es2] usb_unbind_interface+0x7a/0x2c0 __device_release_driver+0x96/0x150 device_release_driver+0x1e/0x30 bus_remove_device+0xe7/0x130 device_del+0x116/0x230 usb_disable_device+0x97/0x1f0 usb_disconnect+0x80/0x260 hub_event+0x5ca/0x10e0 process_one_work+0x126/0x3b0 worker_thread+0x55/0x4c0 ? process_one_work+0x3b0/0x3b0 kthread+0xc4/0xe0 ? kthread_park+0xb0/0xb0 ret_from_fork+0x22/0x30 So, fix that by adding checks before use the callback. Cc: # 4.9.x Signed-off-by: Rui Miguel Silva --- Greg, This patch does not contain the "commit upstream" snippet since you already removed the timesync code from the -next tree. So, It would never get there. However this will affect the greybus users of 4.9.x. drivers/staging/greybus/timesync_platform.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c index 113f3d6c4b3a..7d3ccc2bc98c 100644 --- a/drivers/staging/greybus/timesync_platform.c +++ b/drivers/staging/greybus/timesync_platform.c @@ -45,13 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void) int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata) { + if (!arche_platform_change_state_cb) + return 0; + return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC, pdata); } void gb_timesync_platform_unlock_bus(void) { - arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL); + if (arche_platform_change_state_cb) + arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, + NULL); } static const struct of_device_id arch_timer_of_match[] = { -- 2.11.0