From patchwork Thu Mar 8 19:47:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10268963 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8315C602C8 for ; Thu, 8 Mar 2018 19:48:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 71E6328768 for ; Thu, 8 Mar 2018 19:48:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6605929B1C; Thu, 8 Mar 2018 19:48:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EAB4328768 for ; Thu, 8 Mar 2018 19:48:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751127AbeCHTsI (ORCPT ); Thu, 8 Mar 2018 14:48:08 -0500 Received: from mail-ua0-f196.google.com ([209.85.217.196]:41500 "EHLO mail-ua0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751086AbeCHTrw (ORCPT ); Thu, 8 Mar 2018 14:47:52 -0500 Received: by mail-ua0-f196.google.com with SMTP id u99so650482uau.8 for ; Thu, 08 Mar 2018 11:47:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=sfLCC9HX+D/YbU+bekiWzERsATQLui3PRNdOv6kT5mqMqBi4kM/saQlYF55ImLA/eP UHtJeAUn74DCqXLGqApFLL7Y2vmnnLZe9l8ozhDqEFLBFbKA6uW4ArMEFIGppFjKgXlp uYLXnXb8+64fqlW0qcf/3NMBwlyp1Vb6Q9THhxKtVy5sppA2GH1Sy3z+YYP9GDY9Bu6W mb9RX87EClzw18uwgLhzKkqwwA9dpxkvRC0CdC1oBeM1WsnHW1m10qgbciLlDduDxSG1 4zd9tGn+wuZyt4id9fhmSYXnfytB2jJPpqA/2bJxcfA11+CwCmyW8Rd0vhLGOPM02Ime a0/g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=Nl5n0DPLMybCdsm0B3QpxqKWHJib930flKWsCPfalM6lCLrRSmLSWyV6qjb9GIyIrL mJkeSG/fTNpxmTiYJ/JhqQ0Qj+pFs5rz97L7RpokwtxSwHJ7MF9mlaCZB4Fo3SqE4lDP eJpaRH0XvhZMRv/zX53oXvyHM3mPcYJBDcBvo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=HnMLKgHYmuXA/VyCwAZG7edEcKiLPLck5Fx04YWRGy0=; b=hz0dAWP5nIYUv1dkJjkD39V0lNqcRYbKrBIYyodZkcZ60qOSF66i8VL+QjJlnhR9Ay 1kejR8twenUL53mbE0bPLKJxJi0g8F2EsokqxtNFjiQ1yM3l0JkWQuindgkGoPDALmrc Vv71Y2aT16GrVGvGKFAhm+H8KtdDxu5P464VdykSNOedRBUwVMpSRPFleFpZ5H24kfn/ dl726UsLYv+l2UvwygK3JaQ3hrwPTbgBXh4O903MsiJCruOiisJQqrnlV9Qw0oUudU6F 9XVrySn7rFj1JrMks04WORnkr8iY182btlC6bWeFbhZxPTLIjMaeOGsBgb0BGlvfO/jC opnw== X-Gm-Message-State: APf1xPAZZWNpQDfM01dKsautBgPHm2pAlfjhdFGyCCF6RaMMA7zS03oc jxjX2I+XknLAyI17PYz5ffsb7W4OUgvGk5hMPafAylWfXOM= X-Google-Smtp-Source: AG47ELuYLIsyGuehK67x5OBRB4CFXXvODyS1XzmSvB4OD86Iopv3+a2SPglm+vgZQc0wsM+++J6PtoxDgDfbG6jI+ew= X-Received: by 10.159.36.243 with SMTP id 106mr19684148uar.83.1520538470921; Thu, 08 Mar 2018 11:47:50 -0800 (PST) MIME-Version: 1.0 Received: by 10.31.242.140 with HTTP; Thu, 8 Mar 2018 11:47:50 -0800 (PST) In-Reply-To: <20180308151421.GA13160@amd> References: <20180308151421.GA13160@amd> From: Kees Cook Date: Thu, 8 Mar 2018 11:47:50 -0800 X-Google-Sender-Auth: FuBMPf4G7lXy9j0eo0kSLeeI508 Message-ID: Subject: Re: linux-next on n900: oops in codec_reg_show() when grepping sysfs To: Pavel Machek Cc: pali.rohar@gmail.com, sre@kernel.org, kernel list , linux-arm-kernel , linux-omap@vger.kernel.org, Tony Lindgren , Kevin Hilman , Aaro Koskinen , ivo.g.dimitrov.75@gmail.com, patrikbachan@gmail.com, "Serge E. Hallyn" , abcloriens@gmail.com, Clayton Craft , martijn@brixit.nl, Sakari Ailus , =?UTF-8?Q?Filip_Matijevi=C4=87?= , Mark Brown , peter.ujfalusi@ti.com, moderated for non-subscribers , security@kernel.org Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Mar 8, 2018 at 7:14 AM, Pavel Machek wrote: > Hi! > > pavel@n900:/sys$ uname -a > Linux n900 4.16.0-rc4-next-20180308 #71 Thu Mar 8 15:27:49 CET 2018 > armv7l GNU/Linux > pavel@n900:/sys$ grep -ri fasdfasdf . > > leads to an oops: > > [ 2278.331878] DSS: context saved > [ 2278.820343] Unable to handle kernel NULL pointer dereference at > virtual address 00000004 > [ 2278.828948] pgd = c36040a2 > [ 2278.831787] [00000004] *pgd=876c4831, *pte=00000000, *ppte=00000000 > [ 2278.838439] Internal error: Oops: 17 [#1] ARM > [ 2278.843017] Modules linked in: > [ 2278.846221] CPU: 0 PID: 16337 Comm: grep Tainted: G W > 4.16.0-rc4-next-20180308 #71 > [ 2278.855529] Hardware name: Nokia RX-51 board > [ 2278.860015] PC is at soc_codec_reg_show+0x8/0x19c > [ 2278.864959] LR is at codec_reg_show+0x28/0x30 Looks like a NULL codec (driver has offsetof of 0x4). static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t count, loff_t pos) { ... loff_t p = 0; wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2; ... This would paper over it. I have no idea that the lifetime expectation are for codec and driver... -Kees diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 96c44f6576c9..78ad165ad424 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -137,6 +137,9 @@ static ssize_t soc_codec_reg_show(struct snd_soc_codec *codec, char *buf, size_t total = 0; loff_t p = 0; + if (!codec || !codec->driver) + return 0; + wordsize = min_bytes_needed(codec->driver->reg_cache_size) * 2; regsize = codec->driver->reg_word_size * 2;