[V1,0/1] atmel_mxt_ts: Avoid memory free operation for unallocated kernel memory pointer

Message

Chugh, Sanjeev Dec. 28, 2018, 10:50 a.m. UTC

Please consider taking this patch to prevent kernel oops.
==========================================================
If there is an attempt to update Atmel device a cfg file which
is not in acceptable format or an invalid file. This leads to kernel
hitting a BUG macro in mm/slub.c. This is the callstack seen.

[ 3436.264512] kernel BUG at mm/slub.c:3892!
[ 3436.268549] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[ 3436.378927]  [last unloaded: atmel_mxt_ts]
[ 3436.405034] PC is at kfree+0x70/0x22c
[ 3436.408723] LR is at mxt_configure_objects+0x2b0/0xe60 [atmel_mxt_ts]
[ 3436.528144] Process load_firmware.s (pid: 3852, stack limit = 0xffff00001f2d0000)
[ 3436.535646] Call trace:
[ 3436.538097] Exception stack(0xffff00001f2d3a30 to 0xffff00001f2d3b70)
[ 3436.544554] 3a20:                                   ffff7e0000228e20 ffff7e0000228e20
[ 3436.552403] 3a40: ffff800690dd8f00 00000000002c4841 0000000000000000 0000000000000000
[ 3436.560252] 3a60: ffff000008b88b28 0000000000000371 0000000000000007 0000000000000000
[ 3436.568102] 3a80: ffff000008b88b1e 00000000fffffff2 0000000000000020 ffffffffffffffff
[ 3436.575951] 3aa0: ffff000008b8ab18 00000000ccd114e6 0000000000000000 0000000000000000
[ 3436.583800] 3ac0: 000000000000000a ffff7e0000228e00 ffff000008a38b08 0000000000000000
[ 3436.591649] 3ae0: ffff800696733020 ffff800690815b20 ffff000008a38b08 ffff800696733020
[ 3436.599498] 3b00: ffff800690815ac8 ffff000008741000 ffff80069519f000 ffff00001f2d3b70
[ 3436.607347] 3b20: ffff000000f93118 ffff00001f2d3b70 ffff0000081cf3f0 0000000040000145
[ 3436.615196] 3b40: ffff800690815018 ffff800690815ac8 0000ffffffffffff ffff000000f96c1e
[ 3436.623045] 3b60: ffff00001f2d3b70 ffff0000081cf3f0
[ 3436.627937] [<ffff0000081cf3f0>] kfree+0x70/0x22c
[ 3436.632663] [<ffff000000f93118>] mxt_configure_objects+0x2b0/0xe60 [atmel_mxt_ts]
[ 3436.640173] [<ffff000000f94df8>] mxt_process_operation+0x188/0x4e0 [atmel_mxt_ts]
[ 3436.647682] [<ffff000000f9522c>] mxt_update_cfg_store+0x4c/0x90 [atmel_mxt_ts]
[ 3436.654929] [<ffff0000084781a8>] dev_attr_store+0x18/0x28
[ 3436.660347] [<ffff0000082593dc>] sysfs_kf_write+0x44/0x50
[ 3436.665761] [<ffff000008258470>] kernfs_fop_write+0x130/0x194
[ 3436.671527] [<ffff0000081e2064>] __vfs_write+0x34/0x138
[ 3436.676766] [<ffff0000081e2364>] vfs_write+0xc0/0x17c
[ 3436.681832] [<ffff0000081e25e0>] SyS_write+0x60/0xb8
[ 3436.686809] Exception stack(0xffff00001f2d3ec0 to 0xffff00001f2d4000)
[ 3436.693266] 3ec0: 0000000000000001 000000000e58cc80 0000000000000016 0000000000000000
[ 3436.701116] 3ee0: 0000000000000888 5551000454000000 0000ffffba6d39f0 0000000000000015
[ 3436.708965] 3f00: 0000000000000040 ffffff80ffffffc8 0000000000000000 0000000000000020
[ 3436.716814] 3f20: 0000000000000000 0000000000000000 000000000000003d 0000000000000000
[ 3436.724664] 3f40: 0000000000000000 0000ffffba5f8fe0 0000000000000000 0000000000000016
[ 3436.732513] 3f60: 000000000e58cc80 0000ffffba6d4480 0000000000000016 0000ffffba6d0638
[ 3436.740362] 3f80: 0000000000000016 00000000004a2878 00000000004c0000 0000000000000000
[ 3436.748212] 3fa0: 00000000004c0000 0000ffffc5b1f9a0 0000ffffba5fc1b8 0000ffffc5b1f9a0
[ 3436.756062] 3fc0: 0000ffffba64cd18 0000000020000000 0000000000000001 0000000000000040
[ 3436.763911] 3fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ 3436.771765] [<ffff0000080832c0>] el0_svc_naked+0x34/0x38

Analysis of the above callback suggested that in function mxt_update_cfg,
if file is considered as unrecognised file, in that it will go ahead and
try to free cfg.mem as well which is not allocated yet. So this should be
avoided by not calling kfree(cfg.mem).
=====================================================================
Testing:
Try updating the Atmel device with an invalid file let say just a text
file. This should reproduce the kernel oops.

Sanjeev Chugh (1):
  Input: atmel_mxt_ts: Don't try to free unallocated kernel memory

 drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)