2018-09-17 03:27:41

by He Zhe

Subject: [PATCH] kernel/dma: Fix panic caused by passing cma to command line

From: He Zhe <[email protected]>

early_cma does not check input argument before passing it to
simple_strtoull. The argument would be a NULL pointer if "cma", without
its value, is set in command line and thus causes the following panic.

PANIC: early exception 0xe3 IP 10:ffffffffa3e9db8d error 0 cr2 0x0
[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-yocto-standard+ #7
[ 0.000000] RIP: 0010:_parse_integer_fixup_radix+0xd/0x70
...
[ 0.000000] Call Trace:
[ 0.000000] simple_strtoull+0x29/0x70
[ 0.000000] memparse+0x26/0x90
[ 0.000000] early_cma+0x17/0x6a
[ 0.000000] do_early_param+0x57/0x8e
[ 0.000000] parse_args+0x208/0x320
[ 0.000000] ? rdinit_setup+0x30/0x30
[ 0.000000] parse_early_options+0x29/0x2d
[ 0.000000] ? rdinit_setup+0x30/0x30
[ 0.000000] parse_early_param+0x36/0x4d
[ 0.000000] setup_arch+0x336/0x99e
[ 0.000000] start_kernel+0x6f/0x4e6
[ 0.000000] x86_64_start_reservations+0x24/0x26
[ 0.000000] x86_64_start_kernel+0x6f/0x72
[ 0.000000] secondary_startup_64+0xa4/0xb0

This patch adds a check to prevent the panic.

Signed-off-by: He Zhe <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
---
kernel/dma/contiguous.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
index 286d823..b2a8790 100644
--- a/kernel/dma/contiguous.c
+++ b/kernel/dma/contiguous.c
@@ -49,7 +49,11 @@ static phys_addr_t limit_cmdline;

static int __init early_cma(char *p)
{
- pr_debug("%s(%s)\n", __func__, p);
+ if (!p) {
+ pr_err("Config string not provided\n");
+ return -EINVAL;
+ }
+
size_cmdline = memparse(p, &p);
if (*p != '@')
return 0;
--
2.7.4

2018-09-18 09:29:06

by Marek Szyprowski

Subject: Re: [PATCH] kernel/dma: Fix panic caused by passing cma to command line

Hi

On 2018-09-17 05:24, [email protected] wrote:
> From: He Zhe <[email protected]>
>
> early_cma does not check input argument before passing it to
> simple_strtoull. The argument would be a NULL pointer if "cma", without
> its value, is set in command line and thus causes the following panic.
>
> PANIC: early exception 0xe3 IP 10:ffffffffa3e9db8d error 0 cr2 0x0
> [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-yocto-standard+ #7
> [ 0.000000] RIP: 0010:_parse_integer_fixup_radix+0xd/0x70
> ...
> [ 0.000000] Call Trace:
> [ 0.000000] simple_strtoull+0x29/0x70
> [ 0.000000] memparse+0x26/0x90
> [ 0.000000] early_cma+0x17/0x6a
> [ 0.000000] do_early_param+0x57/0x8e
> [ 0.000000] parse_args+0x208/0x320
> [ 0.000000] ? rdinit_setup+0x30/0x30
> [ 0.000000] parse_early_options+0x29/0x2d
> [ 0.000000] ? rdinit_setup+0x30/0x30
> [ 0.000000] parse_early_param+0x36/0x4d
> [ 0.000000] setup_arch+0x336/0x99e
> [ 0.000000] start_kernel+0x6f/0x4e6
> [ 0.000000] x86_64_start_reservations+0x24/0x26
> [ 0.000000] x86_64_start_kernel+0x6f/0x72
> [ 0.000000] secondary_startup_64+0xa4/0xb0
>
> This patch adds a check to prevent the panic.
>
> Signed-off-by: He Zhe <[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> Cc: [email protected]
> Cc: [email protected]

Thanks for the fix.

Reviewed-by: Marek Szyprowski <[email protected]>

> ---
> kernel/dma/contiguous.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
> index 286d823..b2a8790 100644
> --- a/kernel/dma/contiguous.c
> +++ b/kernel/dma/contiguous.c
> @@ -49,7 +49,11 @@ static phys_addr_t limit_cmdline;
>
> static int __init early_cma(char *p)
> {
> - pr_debug("%s(%s)\n", __func__, p);
> + if (!p) {
> + pr_err("Config string not provided\n");
> + return -EINVAL;
> + }
> +
> size_cmdline = memparse(p, &p);
> if (*p != '@')
> return 0;

Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland

2018-09-20 06:56:44

by Christoph Hellwig

Subject: Re: [PATCH] kernel/dma: Fix panic caused by passing cma to command line

On Tue, Sep 18, 2018 at 11:28:33AM +0200, Marek Szyprowski wrote:
> Hi
>
> On 2018-09-17 05:24, [email protected] wrote:
> > From: He Zhe <[email protected]>
> >
> > early_cma does not check input argument before passing it to
> > simple_strtoull. The argument would be a NULL pointer if "cma", without
> > its value, is set in command line and thus causes the following panic.
> >
> > PANIC: early exception 0xe3 IP 10:ffffffffa3e9db8d error 0 cr2 0x0
> > [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-yocto-standard+ #7
> > [ 0.000000] RIP: 0010:_parse_integer_fixup_radix+0xd/0x70
> > ...
> > [ 0.000000] Call Trace:
> > [ 0.000000] simple_strtoull+0x29/0x70
> > [ 0.000000] memparse+0x26/0x90
> > [ 0.000000] early_cma+0x17/0x6a
> > [ 0.000000] do_early_param+0x57/0x8e
> > [ 0.000000] parse_args+0x208/0x320
> > [ 0.000000] ? rdinit_setup+0x30/0x30
> > [ 0.000000] parse_early_options+0x29/0x2d
> > [ 0.000000] ? rdinit_setup+0x30/0x30
> > [ 0.000000] parse_early_param+0x36/0x4d
> > [ 0.000000] setup_arch+0x336/0x99e
> > [ 0.000000] start_kernel+0x6f/0x4e6
> > [ 0.000000] x86_64_start_reservations+0x24/0x26
> > [ 0.000000] x86_64_start_kernel+0x6f/0x72
> > [ 0.000000] secondary_startup_64+0xa4/0xb0
> >
> > This patch adds a check to prevent the panic.
> >
> > Signed-off-by: He Zhe <[email protected]>
> > Cc: [email protected]
> > Cc: [email protected]
> > Cc: [email protected]
> > Cc: [email protected]
>
> Thanks for the fix.
>
> Reviewed-by: Marek Szyprowski <[email protected]>

Thanks, added to the dma-mapping tree.