2022-11-14 01:21:47

by Hui Tang

Subject: [PATCH] reset: uniphier-glue: Fix possible null-ptr-deref

It will cause null-ptr-deref when resource_size(res) invoked,
if platform_get_resource() returns NULL.

Fixes: 499fef09a323 ("reset: uniphier: add USB3 core reset control")
Signed-off-by: Hui Tang <[email protected]>
---
drivers/reset/reset-uniphier-glue.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/reset/reset-uniphier-glue.c b/drivers/reset/reset-uniphier-glue.c
index 146fd5d45e99..15abac9fc72c 100644
--- a/drivers/reset/reset-uniphier-glue.c
+++ b/drivers/reset/reset-uniphier-glue.c
@@ -47,7 +47,6 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev)
struct device *dev = &pdev->dev;
struct uniphier_glue_reset_priv *priv;
struct resource *res;
- resource_size_t size;
int i, ret;

priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -60,7 +59,6 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev)
return -EINVAL;

res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
- size = resource_size(res);
priv->rdata.membase = devm_ioremap_resource(dev, res);
if (IS_ERR(priv->rdata.membase))
return PTR_ERR(priv->rdata.membase);
@@ -96,7 +94,7 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev)

spin_lock_init(&priv->rdata.lock);
priv->rdata.rcdev.owner = THIS_MODULE;
- priv->rdata.rcdev.nr_resets = size * BITS_PER_BYTE;
+ priv->rdata.rcdev.nr_resets = resource_size(res) * BITS_PER_BYTE;
priv->rdata.rcdev.ops = &reset_simple_ops;
priv->rdata.rcdev.of_node = dev->of_node;
priv->rdata.active_low = true;
--
2.17.1

2022-11-14 01:48:42

by Kunihiko Hayashi

Subject: Re: [PATCH] reset: uniphier-glue: Fix possible null-ptr-deref

On 2022/11/14 9:49, Hui Tang wrote:
> It will cause null-ptr-deref when resource_size(res) invoked,
> if platform_get_resource() returns NULL.
>
> Fixes: 499fef09a323 ("reset: uniphier: add USB3 core reset control")
> Signed-off-by: Hui Tang <[email protected]>
> ---
> drivers/reset/reset-uniphier-glue.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/reset/reset-uniphier-glue.c
> b/drivers/reset/reset-uniphier-glue.c
> index 146fd5d45e99..15abac9fc72c 100644
> --- a/drivers/reset/reset-uniphier-glue.c
> +++ b/drivers/reset/reset-uniphier-glue.c
> @@ -47,7 +47,6 @@ static int uniphier_glue_reset_probe(struct
> platform_device *pdev)
> struct device *dev = &pdev->dev;
> struct uniphier_glue_reset_priv *priv;
> struct resource *res;
> - resource_size_t size;
> int i, ret;
>
> priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
> @@ -60,7 +59,6 @@ static int uniphier_glue_reset_probe(struct
> platform_device *pdev)
> return -EINVAL;
>
> res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> - size = resource_size(res);
> priv->rdata.membase = devm_ioremap_resource(dev, res);
> if (IS_ERR(priv->rdata.membase))
> return PTR_ERR(priv->rdata.membase);
> @@ -96,7 +94,7 @@ static int uniphier_glue_reset_probe(struct
> platform_device *pdev)
>
> spin_lock_init(&priv->rdata.lock);
> priv->rdata.rcdev.owner = THIS_MODULE;
> - priv->rdata.rcdev.nr_resets = size * BITS_PER_BYTE;
> + priv->rdata.rcdev.nr_resets = resource_size(res) * BITS_PER_BYTE;
> priv->rdata.rcdev.ops = &reset_simple_ops;
> priv->rdata.rcdev.of_node = dev->of_node;
> priv->rdata.active_low = true;

Good catch! resource_size() should refer to res after the check.

Reviewed-by: Kunihiko Hayashi <[email protected]>

Thank you,

---
Best Regards
Kunihiko Hayashi

2023-01-03 10:58:30

by Philipp Zabel

Subject: Re: [PATCH] reset: uniphier-glue: Fix possible null-ptr-deref

On Mo, 2022-11-14 at 08:49 +0800, Hui Tang wrote:
> It will cause null-ptr-deref when resource_size(res) invoked,
> if platform_get_resource() returns NULL.
>
> Fixes: 499fef09a323 ("reset: uniphier: add USB3 core reset control")
> Signed-off-by: Hui Tang <[email protected]>

Thank you, applied to reset/fixes.

regards
Philipp