2023-02-12 22:05:03

by Alexander Sverdlin

Subject: [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

Prevent similar scenarios:

Unable to handle kernel NULL pointer dereference at virtual address 00000038
...
PC is at dev_driver_string+0x0/0x38

Signed-off-by: Alexander Sverdlin <[email protected]>
---
drivers/base/core.c | 3 +++
include/linux/device.h | 5 +++++
2 files changed, 8 insertions(+)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index a3e14143ec0c..4ff2ddea7c9b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2174,6 +2174,9 @@ const char *dev_driver_string(const struct device *dev)
{
struct device_driver *drv;

+ if (!dev)
+ return "<null>";
+
/* dev->driver can change to NULL underneath us because of unbinding,
* so be careful about accessing it. dev->bus and dev->class should
* never change once they are set, so they don't need special care.
diff --git a/include/linux/device.h b/include/linux/device.h
index 44e3acae7b36..ff9e19e6d78c 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -696,6 +696,9 @@ static inline bool device_iommu_mapped(struct device *dev)

static inline const char *dev_name(const struct device *dev)
{
+ if (!dev)
+ return "<null>";
+
/* Use the init name until the kobject becomes available */
if (dev->init_name)
return dev->init_name;
@@ -712,6 +715,8 @@ static inline const char *dev_name(const struct device *dev)
*/
static inline const char *dev_bus_name(const struct device *dev)
{
+ if (!dev)
+ return "<null>";
return dev->bus ? dev->bus->name : (dev->class ? dev->class->name : "");
}

--
2.39.1

2023-02-13 07:07:20

by Greg Kroah-Hartman

Subject: Re: [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

On Sun, Feb 12, 2023 at 11:04:41PM +0100, Alexander Sverdlin wrote:
> Prevent similar scenarios:
>
> Unable to handle kernel NULL pointer dereference at virtual address 00000038
> ...
> PC is at dev_driver_string+0x0/0x38

How did this "scenario" happen? What in-tree code caused this?

>
> Signed-off-by: Alexander Sverdlin <[email protected]>
> ---
> drivers/base/core.c | 3 +++
> include/linux/device.h | 5 +++++
> 2 files changed, 8 insertions(+)
>
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index a3e14143ec0c..4ff2ddea7c9b 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -2174,6 +2174,9 @@ const char *dev_driver_string(const struct device *dev)
> {
> struct device_driver *drv;
>
> + if (!dev)
> + return "<null>";
> +

None of these functions should be called with a NULL pointer as the
reference should have been properly gotten on them before calling these
functions. So let's fix up the callers please, something is really
wrong with them. Again, what in-tree code is causing this to happen?

thanks,

greg k-h

2023-02-13 07:12:16

by Alexander Sverdlin

Subject: Re: [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

Hi Greg,

On Mon, 2023-02-13 at 08:07 +0100, Greg Kroah-Hartman wrote:
> > Prevent similar scenarios:
> >
> > Unable to handle kernel NULL pointer dereference at virtual address 00000038
> > ...
> > PC is at dev_driver_string+0x0/0x38
>
> How did this "scenario" happen?  What in-tree code caused this?
>

such in-tree code is not known to me, I stubled upon this putting dev_info()
all over the code in the platform we currently convert to DT (cirrus ep93xx).

> > Signed-off-by: Alexander Sverdlin <[email protected]>
> > ---
> >   drivers/base/core.c    | 3 +++
> >   include/linux/device.h | 5 +++++
> >   2 files changed, 8 insertions(+)
> >
> > diff --git a/drivers/base/core.c b/drivers/base/core.c
> > index a3e14143ec0c..4ff2ddea7c9b 100644
> > --- a/drivers/base/core.c
> > +++ b/drivers/base/core.c
> > @@ -2174,6 +2174,9 @@ const char *dev_driver_string(const struct device *dev)
> >   {
> >         struct device_driver *drv;
> >  
> > +       if (!dev)
> > +               return "<null>";
> > +
>
> None of these functions should be called with a NULL pointer as the
> reference should have been properly gotten on them before calling these
> functions.  So let's fix up the callers please, something is really
> wrong with them.  Again, what in-tree code is causing this to happen?

Thanks for the explanation!

--
Alexander Sverdlin.

2023-02-13 07:16:14

by Greg Kroah-Hartman

Subject: Re: [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

On Mon, Feb 13, 2023 at 08:12:08AM +0100, Alexander Sverdlin wrote:
> Hi Greg,
>
> On Mon, 2023-02-13 at 08:07 +0100, Greg Kroah-Hartman wrote:
> > > Prevent similar scenarios:
> > >
> > > Unable to handle kernel NULL pointer dereference at virtual address 00000038
> > > ...
> > > PC is at dev_driver_string+0x0/0x38
> >
> > How did this "scenario" happen?? What in-tree code caused this?
> >
>
> such in-tree code is not known to me, I stubled upon this putting dev_info()
> all over the code in the platform we currently convert to DT (cirrus ep93xx).

Instead of using dev_info() for tracing, use ftrace instead, that's what
it is there for! :)

thanks,

greg k-h