Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread YueHaibing 
On 2019/5/16 17:51, Mark Brown wrote:
> On Thu, May 16, 2019 at 03:56:56PM +0800, YueHaibing wrote:
> 
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 
>> 04/01/2014
>> Call Trace:
>>  dump_stack+0xa9/0x10e
>>  ? __list_del_entry_valid+0x45/0xd0
>>  ? __list_del_entry_valid+0x45/0xd0
>>  __kasan_report+0x171/0x18d
>>  ? __list_del_entry_valid+0x45/0xd0
>>  kasan_report+0xe/0x20
> 
> Please think hard before including complete backtraces in upstream
> reports, they are very large and contain almost no useful information
> relative to their size so often obscure the relevant content in your
> message. If part of the backtrace is usefully illustrative then it's
> usually better to pull out the relevant sections.

Thanks, got it.

>

Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread Mark Brown 
On Thu, May 16, 2019 at 03:56:56PM +0800, YueHaibing wrote:

> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 
> 04/01/2014
> Call Trace:
>  dump_stack+0xa9/0x10e
>  ? __list_del_entry_valid+0x45/0xd0
>  ? __list_del_entry_valid+0x45/0xd0
>  __kasan_report+0x171/0x18d
>  ? __list_del_entry_valid+0x45/0xd0
>  kasan_report+0xe/0x20

Please think hard before including complete backtraces in upstream
reports, they are very large and contain almost no useful information
relative to their size so often obscure the relevant content in your
message. If part of the backtrace is usefully illustrative then it's
usually better to pull out the relevant sections.


signature.asc
Description: PGP signature

Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread Mukesh Ojha 



On 5/16/2019 1:26 PM, YueHaibing wrote:

If spi_register_master fails in spi_bitbang_start
because device_add failure, We should return the
error code other than 0, otherwise calling
spi_bitbang_stop may trigger NULL pointer dereference
like this:

BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
Read of size 8 at addr  by task syz-executor.0/3661

CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 
04/01/2014
Call Trace:
  dump_stack+0xa9/0x10e
  ? __list_del_entry_valid+0x45/0xd0
  ? __list_del_entry_valid+0x45/0xd0
  __kasan_report+0x171/0x18d
  ? __list_del_entry_valid+0x45/0xd0
  kasan_report+0xe/0x20
  __list_del_entry_valid+0x45/0xd0
  spi_unregister_controller+0x99/0x1b0
  spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
  ? 0xc1128000
  ? klist_next+0x131/0x1e0
  ? driver_detach+0x40/0x40 [parport]
  port_check+0x3b/0x50 [parport]
  bus_for_each_dev+0x115/0x180
  ? subsys_dev_iter_exit+0x20/0x20
  __parport_register_driver+0x1f0/0x210 [parport]
  ? 0xc115
  do_one_initcall+0xb9/0x3b5
  ? perf_trace_initcall_level+0x270/0x270
  ? kasan_unpoison_shadow+0x30/0x40
  ? kasan_unpoison_shadow+0x30/0x40
  do_init_module+0xe0/0x330
  load_module+0x38eb/0x4270
  ? module_frob_arch_sections+0x20/0x20
  ? kernel_read_file+0x188/0x3f0
  ? find_held_lock+0x6d/0xd0
  ? fput_many+0x1a/0xe0
  ? __do_sys_finit_module+0x162/0x190
  __do_sys_finit_module+0x162/0x190
  ? __ia32_sys_init_module+0x40/0x40
  ? __mutex_unlock_slowpath+0xb4/0x3f0
  ? wait_for_completion+0x240/0x240
  ? vfs_write+0x160/0x2a0
  ? lockdep_hardirqs_off+0xb5/0x100
  ? mark_held_locks+0x1a/0x90
  ? do_syscall_64+0x14/0x2a0
  do_syscall_64+0x72/0x2a0
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reported-by: Hulk Robot 
Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to 
master")
Signed-off-by: YueHaibing 

Reviewed-by: Mukesh Ojha 

Cheers,
-Mukesh


---
  drivers/spi/spi-bitbang.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index dd9a8c54..be95be4 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -403,7 +403,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
if (ret)
spi_master_put(master);
  
-	return 0;

+   return ret;
  }
  EXPORT_SYMBOL_GPL(spi_bitbang_start);

Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread Axel Lin 
YueHaibing  於 2019年5月16日 週四 下午3:57寫道：
>
> If spi_register_master fails in spi_bitbang_start
> because device_add failure, We should return the
> error code other than 0, otherwise calling
> spi_bitbang_stop may trigger NULL pointer dereference
> like this:

Reviewed-by: Axel Lin

Re: [PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread Geert Uytterhoeven 
On Thu, May 16, 2019 at 9:57 AM YueHaibing  wrote:
> If spi_register_master fails in spi_bitbang_start
> because device_add failure, We should return the
> error code other than 0, otherwise calling
> spi_bitbang_stop may trigger NULL pointer dereference
> like this:
>
> BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
> Read of size 8 at addr  by task syz-executor.0/3661

[...]

> Reported-by: Hulk Robot 
> Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference 
> to master")
> Signed-off-by: YueHaibing 

Reviewed-by: Geert Uytterhoeven 

Gr{oetje,eeting}s,

Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

[PATCH] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master

2019-05-16 Thread YueHaibing 
If spi_register_master fails in spi_bitbang_start
because device_add failure, We should return the
error code other than 0, otherwise calling
spi_bitbang_stop may trigger NULL pointer dereference
like this:

BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
Read of size 8 at addr  by task syz-executor.0/3661

CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 
04/01/2014
Call Trace:
 dump_stack+0xa9/0x10e
 ? __list_del_entry_valid+0x45/0xd0
 ? __list_del_entry_valid+0x45/0xd0
 __kasan_report+0x171/0x18d
 ? __list_del_entry_valid+0x45/0xd0
 kasan_report+0xe/0x20
 __list_del_entry_valid+0x45/0xd0
 spi_unregister_controller+0x99/0x1b0
 spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
 ? 0xc1128000
 ? klist_next+0x131/0x1e0
 ? driver_detach+0x40/0x40 [parport]
 port_check+0x3b/0x50 [parport]
 bus_for_each_dev+0x115/0x180
 ? subsys_dev_iter_exit+0x20/0x20
 __parport_register_driver+0x1f0/0x210 [parport]
 ? 0xc115
 do_one_initcall+0xb9/0x3b5
 ? perf_trace_initcall_level+0x270/0x270
 ? kasan_unpoison_shadow+0x30/0x40
 ? kasan_unpoison_shadow+0x30/0x40
 do_init_module+0xe0/0x330
 load_module+0x38eb/0x4270
 ? module_frob_arch_sections+0x20/0x20
 ? kernel_read_file+0x188/0x3f0
 ? find_held_lock+0x6d/0xd0
 ? fput_many+0x1a/0xe0
 ? __do_sys_finit_module+0x162/0x190
 __do_sys_finit_module+0x162/0x190
 ? __ia32_sys_init_module+0x40/0x40
 ? __mutex_unlock_slowpath+0xb4/0x3f0
 ? wait_for_completion+0x240/0x240
 ? vfs_write+0x160/0x2a0
 ? lockdep_hardirqs_off+0xb5/0x100
 ? mark_held_locks+0x1a/0x90
 ? do_syscall_64+0x14/0x2a0
 do_syscall_64+0x72/0x2a0
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reported-by: Hulk Robot 
Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to 
master")
Signed-off-by: YueHaibing 
---
 drivers/spi/spi-bitbang.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
index dd9a8c54..be95be4 100644
--- a/drivers/spi/spi-bitbang.c
+++ b/drivers/spi/spi-bitbang.c
@@ -403,7 +403,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
if (ret)
spi_master_put(master);
 
-   return 0;
+   return ret;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_start);
 
-- 
1.8.3.1