From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751320AbbGLStz (ORCPT ); Sun, 12 Jul 2015 14:49:55 -0400 Received: from smtprelay0162.hostedemail.com ([216.40.44.162]:50111 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751061AbbGLStx (ORCPT ); Sun, 12 Jul 2015 14:49:53 -0400 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,rostedt@goodmis.org,:::::::::::::::::,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1277:1311:1313:1314:1345:1437:1515:1516:1518:1535:1544:1593:1594:1711:1730:1747:1777:1792:2393:2559:2562:3138:3139:3140:3141:3142:3354:3865:3866:3867:3868:3870:3871:3872:3874:4250:4321:5007:6119:6238:6261:7903:8660:8784:8957:9040:9163:10004:10848:11026:11232:11658:11914:12043:12296:12438:12517:12519:12555:12679:12710:12737:12740:13148:13230:13870:14096:14097:14394:21080,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0 X-HE-Tag: pain70_902fbaaf5080a X-Filterd-Recvd-Size: 5474 Date: Sun, 12 Jul 2015 14:49:49 -0400 From: Steven Rostedt To: LKML Cc: Linus Torvalds , Rusty Russell , David Howells , Ming Lei , Seth Forshee , Kyle McMartin , "Luis R. Rodriguez" , Greg Kroah-Hartman Subject: [PATCH] firmware: Fix dereferencing NULL pointer of fw_priv->buf->fw_id Message-ID: <20150712144949.7e984c63@gandalf.local.home> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.28; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit e0fd9b1d9c44c0 ("firmware: use const for remaining firmware names") converted struct firware_buf fw_id from a string within the structure to a pointer to a constant string. Unfortunately, this caused the following BUG: BUG: unable to handle kernel NULL pointer dereference at 00000000000000c0 IP: [] firmware_uevent+0x2f/0xaa PGD d325c067 PUD d3fc8067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: ip6t_REJECT nf_reject_ipv6 xt_tcpudp nf_conntrack_ipv6 nf_defrag_ipv6 xt_state ip6table_filter ip6_tables x_tables microcode r8169 CPU: 0 PID: 1019 Comm: NetworkManager Not tainted 4.1.0-rc4-test+ #48 Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6 02/22/2014 task: ffff8800d35fc000 ti: ffff8800d363c000 task.ti: ffff8800d363c000 RIP: 0010:[] [] firmware_uevent+0x2f/0xaa RSP: 0018:ffff8800d363f648 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff880211d17008 RCX: 0000000000000003 RDX: 0000000000000000 RSI: ffffffff828614b4 RDI: ffff880211d17008 RBP: ffff8800d363f668 R08: 00000000fffffffd R09: 0000000000000202 R10: ffffffffffffffff R11: 000000000000005f R12: 00000000fffffff4 R13: ffff880212484010 R14: ffff880212484010 R15: ffffffff823b88e0 FS: 00007f849a3107e0(0000) GS:ffff88021dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000c0 CR3: 00000000d31a4000 CR4: 00000000001406f0 Stack: 00000000fffffffd ffff880212484020 0000000000000000 ffff880211d17008 ffff8800d363f6b8 ffffffff8180ecad ffff8800d363f6b8 ffffffff814f6a9e ffffffff82867bfb 0000000000000002 0000000000000000 ffff880211d17008 Call Trace: [] dev_uevent+0x273/0x374 [] ? kobject_get_path+0xbe/0x126 [] kobject_uevent_env+0x3af/0x80b [] kobject_uevent+0x12/0x1b [] device_del+0x29f/0x2e6 [] _request_firmware+0xa2c/0xd03 [] request_firmware+0x15/0x1e [] rtl_open+0x417/0xaf5 [r8169] [] __dev_open+0x110/0x18e [] __dev_change_flags+0xec/0x1cd [] dev_change_flags+0x2a/0x75 [] do_setlink+0x3c2/0x9a6^M [] ? mark_lock+0x34/0x363 [] rtnl_setlink+0x129/0x13e [] ? __netlink_ns_capable+0x4b/0x72 [] rtnetlink_rcv_msg+0x241/0x257 [] ? rtnl_lock+0x19/0x22 [] ? __rtnl_unlock+0x20/0x20 [] netlink_rcv_skb+0x72/0xf0 [] rtnetlink_rcv+0x2f/0x44^M [] netlink_unicast+0x160/0x24f [] netlink_sendmsg+0x3d9/0x42e [] sock_sendmsg_nosec+0x16/0x36 [] ___sys_sendmsg+0x19d/0x229 [] ? sock_sendmsg_nosec+0x16/0x36 [] ? SYSC_sendto+0x129/0x146 [] ? emulate_vsyscall+0x313/0x437 [] ? __fget_light+0x5c/0xbc [] __sys_sendmsg+0x52/0x7e [] SyS_sendmsg+0x10/0x19 [] system_call_fastpath+0x12/0x6f This was caused by firware_uevent() that dereferenced buf: fw_priv->buf->fw_id. I guess when fw_id was part of buf, if buf was NULL, this pointer too was NULL. But now that it is a pointer to a string and not just part of buf, it is a dereference of NULL when buf is NULL causing the above crash. Add a check to see if buf is NULL before dereferencing it. Fixes: e0fd9b1d9c44 ("firmware: use const for remaining firmware names") Signed-off-by: Steven Rostedt --- Now it seems that I have workarounds to test against v4.2-rc1 after fixing/finding 3 bugs! diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 9c4288362a8e..071f22a630ce 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -567,7 +567,8 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env) { struct firmware_priv *fw_priv = to_firmware_priv(dev); - if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id)) + if (add_uevent_var(env, "FIRMWARE=%s", + fw_priv->buf ? fw_priv->buf->fw_id : NULL)) return -ENOMEM; if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout)) return -ENOMEM;