2020-03-06 17:48:59

by Alexander Sverdlin

Subject: [PATCH] genirq/irqdomain: Check for NULL in irq_domain_alloc_irqs_hierarchy()

From: Alexander Sverdlin <[email protected]>

irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit
but only one of them checks for the pointer which is being dereferenced
inside the called function. Move the check into the function. This allows
for catching the error instead of the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = 1845a981
[00000000] *pgd=0669c003, *pmd=1f83ff003
Internal error: Oops: 80000207 [#1] PREEMPT SMP THUMB2
Modules linked in: ...
CPU: 4 PID: 3665 Comm: modprobe Tainted: G W O 5.4.15-... #1
Hardware name: LSI Axxia AXM55XX
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
pc : [<00000000>] lr : [<c06c23ff>] psr: 200e0013
sp : c68d5c10 ip : 00000000 fp : d5589900
r10: 00000001 r9 : c68d5c34 r8 : 000002f8
r7 : d60dfe48 r6 : d60a8880 r5 : c06c1899 r4 : c0e04cc8
r3 : c68d5c34 r2 : 00000001 r1 : 000002f8 r0 : e0818800
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 70c5387d Table: 077d4b00 DAC: 55555555
Process modprobe (pid: 3665, stack limit = 0xd2112104)
Stack: (0xc68d5c10 to 0xc68d6000)
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc) from [<c0462a89>] (__irq_domain_alloc_irqs+0xe1/0x24c)
[<c0462a89>] (__irq_domain_alloc_irqs) from [<c0462dad>] (irq_create_fwspec_mapping+0x75/0x194)
[<c0462dad>] (irq_create_fwspec_mapping) from [<c06c2251>] (gpiochip_to_irq+0x5d/0x68)
[<c06c2251>] (gpiochip_to_irq) from [<c06c1c9b>] (gpiod_to_irq+0x2b/0x3c)
[<c06c1c9b>] (gpiod_to_irq) from [<bf973073>] (gpio_irqs_init+0x67/0x170 [gpio_irqs])
[<bf973073>] (gpio_irqs_init [gpio_irqs]) from [<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value

Signed-off-by: Alexander Sverdlin <[email protected]>
---
kernel/irq/irqdomain.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index c1f8fa4..7496eb1 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1326,6 +1326,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
unsigned int irq_base,
unsigned int nr_irqs, void *arg)
{
+ if (!domain->ops->alloc) {
+ pr_debug("domain->ops->alloc() is NULL\n");
+ return -ENOSYS;
+ }
+
return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
}

@@ -1363,11 +1368,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
return -EINVAL;
}

- if (!domain->ops->alloc) {
- pr_debug("domain->ops->alloc() is NULL\n");
- return -ENOSYS;
- }
-
if (realloc && irq_base >= 0) {
virq = irq_base;
} else {
--
2.4.6

2020-03-08 12:09:09

by tip-bot2 for Alexey Makhalov

Subject: [tip: irq/core] genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()

The following commit has been merged into the irq/core branch of tip:

Commit-ID: 87f2d1c662fa1761359fdf558246f97e484d177a
Gitweb: https://git.kernel.org/tip/87f2d1c662fa1761359fdf558246f97e484d177a
Author: Alexander Sverdlin <[email protected]>
AuthorDate: Fri, 06 Mar 2020 18:47:20 +01:00
Committer: Thomas Gleixner <[email protected]>
CommitterDate: Sun, 08 Mar 2020 13:03:41 +01:00

genirq/irqdomain: Check pointer in irq_domain_alloc_irqs_hierarchy()

irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit
but only one of them checks for the pointer which is being dereferenced
inside the called function. Move the check into the function. This allows
for catching the error instead of the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc)
[<c0462a89>] (__irq_domain_alloc_irqs)
[<c0462dad>] (irq_create_fwspec_mapping)
[<c06c2251>] (gpiochip_to_irq)
[<c06c1c9b>] (gpiod_to_irq)
[<bf973073>] (gpio_irqs_init [gpio_irqs])
[<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value

Signed-off-by: Alexander Sverdlin <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]

---
kernel/irq/irqdomain.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index fdfc213..35b8d97 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1310,6 +1310,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
unsigned int irq_base,
unsigned int nr_irqs, void *arg)
{
+ if (!domain->ops->alloc) {
+ pr_debug("domain->ops->alloc() is NULL\n");
+ return -ENOSYS;
+ }
+
return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
}

@@ -1347,11 +1352,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
return -EINVAL;
}

- if (!domain->ops->alloc) {
- pr_debug("domain->ops->alloc() is NULL\n");
- return -ENOSYS;
- }
-
if (realloc && irq_base >= 0) {
virq = irq_base;
} else {