Kuppuswamy Sathyanarayanan
fe5135063a
drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish
[ Upstream commit 388bcc6ecc609fca1b4920de7dc3806c98ec535e ]
If platform bus driver registration is failed then, accessing
platform bus spin lock (&drv->driver.bus->p->klist_drivers.k_lock)
in __platform_driver_probe() without verifying the return value
__platform_driver_register() can lead to NULL pointer exception.
So check the return value before attempting the spin lock.
One such example is below:
For a custom usecase, I have intentionally failed the platform bus
registration and I expected all the platform device/driver
registrations to fail gracefully. But I came across this panic
issue.
[ 1.331067] BUG: kernel NULL pointer dereference, address: 00000000000000c8
[ 1.331118] #PF: supervisor write access in kernel mode
[ 1.331163] #PF: error_code(0x0002) - not-present page
[ 1.331208] PGD 0 P4D 0
[ 1.331233] Oops: 0002 [#1] PREEMPT SMP
[ 1.331268] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 5.6.0-00049-g670d35fb0144 #165
[ 1.331341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[ 1.331406] RIP: 0010:_raw_spin_lock+0x15/0x30
[ 1.331588] RSP: 0000:ffffc9000001be70 EFLAGS: 00010246
[ 1.331632] RAX: 0000000000000000 RBX: 00000000000000c8 RCX: 0000000000000001
[ 1.331696] RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000000
[ 1.331754] RBP: 00000000ffffffed R08: 0000000000000501 R09: 0000000000000001
[ 1.331817] R10: ffff88817abcc520 R11: 0000000000000670 R12: 00000000ffffffed
[ 1.331881] R13: ffffffff82dbc268 R14: ffffffff832f070a R15: 0000000000000000
[ 1.331945] FS: 0000000000000000(0000) GS:ffff88817bd80000(0000) knlGS:0000000000000000
[ 1.332008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.332062] CR2: 00000000000000c8 CR3: 000000000681e001 CR4: 00000000003606e0
[ 1.332126] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1.332189] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1.332252] Call Trace:
[ 1.332281] __platform_driver_probe+0x92/0xee
[ 1.332323] ? rtc_dev_init+0x2b/0x2b
[ 1.332358] cmos_init+0x37/0x67
[ 1.332396] do_one_initcall+0x7d/0x168
[ 1.332428] kernel_init_freeable+0x16c/0x1c9
[ 1.332473] ? rest_init+0xc0/0xc0
[ 1.332508] kernel_init+0x5/0x100
[ 1.332543] ret_from_fork+0x1f/0x30
[ 1.332579] CR2: 00000000000000c8
[ 1.332616] ---[ end trace 3bd87f12e9010b87 ]---
[ 1.333549] note: swapper/0[1] exited with preempt_count 1
[ 1.333592] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[ 1.333736] Kernel Offset: disabled
Note, this can only be triggered if a driver errors out from this call,
which should never happen. If it does, the driver needs to be fixed.
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/r/20200408214003.3356-1-sathyanarayanan.kuppuswamy@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2020-06-30 15:38:24 -04:00 |
| .. |
|
power
|
PM / core: Propagate dev->power.wakeup_path when no callbacks
|
2019-05-31 06:48:26 -07:00 |
|
regmap
|
regmap: fix bulk writes on paged registers
|
2019-08-04 09:33:19 +02:00 |
|
attribute_container.c
|
attribute_container: Fix typo
|
2016-08-31 15:13:56 +02:00 |
|
base.h
|
PM / sleep: prohibit devices probing during suspend/hibernation
|
2015-11-30 14:47:22 +01:00 |
|
bus.c
|
sysfs: Disable lockdep for driver bind/unbind files
|
2019-01-26 09:38:35 +01:00 |
|
cacheinfo.c
|
drivers: base: cacheinfo: fix boot error message when acpi is enabled
|
2018-01-31 12:55:51 +01:00 |
|
class.c
|
|
|
|
component.c
|
component: Silence bind error on -EPROBE_DEFER
|
2020-05-27 16:41:46 +02:00 |
|
container.c
|
|
|
|
core.c
|
cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
|
2019-10-29 09:15:25 +01:00 |
|
cpu.c
|
x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
|
2020-06-11 09:22:23 +02:00 |
|
dd.c
|
driver core: Print device when resources present in really_probe()
|
2020-02-28 15:42:32 +01:00 |
|
devcoredump.c
|
devcoredump: add scatterlist support
|
2016-04-15 11:20:32 -07:00 |
|
devres.c
|
|
|
|
devtmpfs.c
|
wrappers for ->i_mutex access
|
2016-01-22 18:04:28 -05:00 |
|
dma-coherent.c
|
drivers: dma-coherent: Move spinlock in dma_alloc_from_coherent()
|
2016-09-28 17:53:16 +02:00 |
|
dma-contiguous.c
|
driver core update for 4.4-rc1
|
2015-11-04 21:50:37 -08:00 |
|
dma-mapping.c
|
drivers/base dmam_declare_coherent_memory leaks
|
2016-08-31 15:19:55 +02:00 |
|
driver.c
|
|
|
|
firmware.c
|
|
|
|
firmware_class.c
|
firmware: fix usermode helper fallback loading
|
2017-01-09 08:32:22 +01:00 |
|
hypervisor.c
|
|
|
|
init.c
|
|
|
|
isa.c
|
isa: Prevent NULL dereference in isa_bus driver callbacks
|
2017-12-14 09:28:11 +01:00 |
|
Kconfig
|
sysfs/cpu: Add vulnerability folder
|
2018-01-17 09:38:57 +01:00 |
|
Makefile
|
isa: Allow ISA-style drivers on modern systems
|
2016-06-17 20:21:12 -07:00 |
|
map.c
|
|
|
|
memory.c
|
mm/memory_hotplug: Do not unlock when fails to take the device_hotplug_lock
|
2019-11-28 18:29:02 +01:00 |
|
module.c
|
base: make module_create_drivers_dir race-free
|
2016-06-15 19:21:31 -07:00 |
|
node.c
|
treewide: replace obsolete _refok by __ref
|
2016-08-02 17:31:41 -04:00 |
|
pinctrl.c
|
driver: base: pinctrl: return error from pinctrl_bind_pins()
|
2016-09-13 23:02:59 +02:00 |
|
platform-msi.c
|
platform-msi: Free descriptors in platform_msi_domain_free()
|
2019-01-09 16:16:43 +01:00 |
|
platform.c
|
drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish
|
2020-06-30 15:38:24 -04:00 |
|
property.c
|
device property: Track owner device of device property
|
2017-10-18 09:35:39 +02:00 |
|
soc.c
|
base: soc: Export soc_device_register/unregister APIs
|
2019-10-05 12:30:20 +02:00 |
|
syscore.c
|
|
|
|
topology.c
|
topology/sysfs: provide drawer id and siblings attributes
|
2016-06-13 15:58:27 +02:00 |
|
transport_class.c
|
|
|