* [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
@ 2022-11-11 1:53 Chen Zhongjin
2022-11-11 1:53 ` Chen Zhongjin
0 siblings, 1 reply; 4+ messages in thread
From: Chen Zhongjin @ 2022-11-11 1:53 UTC (permalink / raw)
To: linux-kernel; +Cc: gregkh, linmq006, chenzhongjin
KASAN reported a null-ptr-deref error:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 1373 Comm: modprobe
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:dmi_sysfs_entry_release
...
Call Trace:
<TASK>
kobject_put
dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
dmi_decode_table (drivers/firmware/dmi_scan.c:133)
dmi_walk (drivers/firmware/dmi_scan.c:1115)
dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
do_one_initcall (init/main.c:1296)
...
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x4000000 from 0xffffffff81000000
---[ end Kernel panic - not syncing: Fatal exception ]---
It is because previous patch added kobject_put() to release the memory
which will call dmi_sysfs_entry_release() and list_del().
However, list_add_tail(entry->list) is called after the error block,
so the list_head is uninitialized and cannot be deleted.
Move error handling to after list_add_tail to fix this.
Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
v1 -> v2:
Change fix to moving error handling to after list_add_tail.
So that it is consistent with kobject_put(&entry->kobj) in other
places.
---
drivers/firmware/dmi-sysfs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index 66727ad3361b..402217c57033 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
*ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL,
"%d-%d", dh->type, entry->instance);
- if (*ret) {
- kobject_put(&entry->kobj);
- return;
- }
-
/* Thread on the global list for cleanup */
spin_lock(&entry_list_lock);
list_add_tail(&entry->list, &entry_list);
spin_unlock(&entry_list_lock);
+ if (*ret) {
+ kobject_put(&entry->kobj);
+ return;
+ }
+
/* Handle specializations by type */
switch (dh->type) {
case DMI_ENTRY_SYSTEM_EVENT_LOG:
--
2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
2022-11-11 1:53 [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Chen Zhongjin
@ 2022-11-11 1:53 ` Chen Zhongjin
2022-11-11 6:18 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Chen Zhongjin @ 2022-11-11 1:53 UTC (permalink / raw)
To: linux-kernel; +Cc: gregkh, linmq006, chenzhongjin
KASAN reported a null-ptr-deref error:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 1373 Comm: modprobe
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:dmi_sysfs_entry_release
...
Call Trace:
<TASK>
kobject_put
dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
dmi_decode_table (drivers/firmware/dmi_scan.c:133)
dmi_walk (drivers/firmware/dmi_scan.c:1115)
dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
do_one_initcall (init/main.c:1296)
...
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x4000000 from 0xffffffff81000000
---[ end Kernel panic - not syncing: Fatal exception ]---
It is because previous patch added kobject_put() to release the memory
which will call dmi_sysfs_entry_release() and list_del().
However, list_add_tail(entry->list) is called after the error block,
so the list_head is uninitialized and cannot be deleted.
Move error handling to after list_add_tail to fix this.
Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
v1 -> v2:
Change fix to moving error handling to after list_add_tail.
So that it is consistent with kobject_put(&entry->kobj) in other
places.
---
drivers/firmware/dmi-sysfs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index 66727ad3361b..402217c57033 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
*ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL,
"%d-%d", dh->type, entry->instance);
- if (*ret) {
- kobject_put(&entry->kobj);
- return;
- }
-
/* Thread on the global list for cleanup */
spin_lock(&entry_list_lock);
list_add_tail(&entry->list, &entry_list);
spin_unlock(&entry_list_lock);
+ if (*ret) {
+ kobject_put(&entry->kobj);
+ return;
+ }
+
/* Handle specializations by type */
switch (dh->type) {
case DMI_ENTRY_SYSTEM_EVENT_LOG:
--
2.17.1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
2022-11-11 1:53 ` Chen Zhongjin
@ 2022-11-11 6:18 ` Greg KH
2022-11-11 6:21 ` Chen Zhongjin
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2022-11-11 6:18 UTC (permalink / raw)
To: Chen Zhongjin; +Cc: linux-kernel, linmq006
On Fri, Nov 11, 2022 at 09:53:26AM +0800, Chen Zhongjin wrote:
> KASAN reported a null-ptr-deref error:
>
> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> CPU: 0 PID: 1373 Comm: modprobe
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
> RIP: 0010:dmi_sysfs_entry_release
> ...
> Call Trace:
> <TASK>
> kobject_put
> dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
> dmi_decode_table (drivers/firmware/dmi_scan.c:133)
> dmi_walk (drivers/firmware/dmi_scan.c:1115)
> dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
> do_one_initcall (init/main.c:1296)
> ...
> Kernel panic - not syncing: Fatal exception
> Kernel Offset: 0x4000000 from 0xffffffff81000000
> ---[ end Kernel panic - not syncing: Fatal exception ]---
>
> It is because previous patch added kobject_put() to release the memory
> which will call dmi_sysfs_entry_release() and list_del().
>
> However, list_add_tail(entry->list) is called after the error block,
> so the list_head is uninitialized and cannot be deleted.
>
> Move error handling to after list_add_tail to fix this.
>
> Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
> ---
> v1 -> v2:
> Change fix to moving error handling to after list_add_tail.
> So that it is consistent with kobject_put(&entry->kobj) in other
> places.
<snip>
I got 2 copies of this, which one is correct?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
2022-11-11 6:18 ` Greg KH
@ 2022-11-11 6:21 ` Chen Zhongjin
0 siblings, 0 replies; 4+ messages in thread
From: Chen Zhongjin @ 2022-11-11 6:21 UTC (permalink / raw)
To: Greg KH; +Cc: linux-kernel, linmq006
Hi,
On 2022/11/11 14:18, Greg KH wrote:
> On Fri, Nov 11, 2022 at 09:53:26AM +0800, Chen Zhongjin wrote:
>> KASAN reported a null-ptr-deref error:
>>
>> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
>> CPU: 0 PID: 1373 Comm: modprobe
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
>> RIP: 0010:dmi_sysfs_entry_release
>> ...
>> Call Trace:
>> <TASK>
>> kobject_put
>> dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
>> dmi_decode_table (drivers/firmware/dmi_scan.c:133)
>> dmi_walk (drivers/firmware/dmi_scan.c:1115)
>> dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
>> do_one_initcall (init/main.c:1296)
>> ...
>> Kernel panic - not syncing: Fatal exception
>> Kernel Offset: 0x4000000 from 0xffffffff81000000
>> ---[ end Kernel panic - not syncing: Fatal exception ]---
>>
>> It is because previous patch added kobject_put() to release the memory
>> which will call dmi_sysfs_entry_release() and list_del().
>>
>> However, list_add_tail(entry->list) is called after the error block,
>> so the list_head is uninitialized and cannot be deleted.
>>
>> Move error handling to after list_add_tail to fix this.
>>
>> Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
>> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
>> ---
>> v1 -> v2:
>> Change fix to moving error handling to after list_add_tail.
>> So that it is consistent with kobject_put(&entry->kobj) in other
>> places.
> <snip>
>
> I got 2 copies of this, which one is correct?
Sorry I accidentally re-sent this, they are all same.
Thanks!
Chen
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-11-11 6:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-11 1:53 [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle Chen Zhongjin
2022-11-11 1:53 ` Chen Zhongjin
2022-11-11 6:18 ` Greg KH
2022-11-11 6:21 ` Chen Zhongjin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®