Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965808AbbDVQOe (ORCPT ); Wed, 22 Apr 2015 12:14:34 -0400 Received: from mail-la0-f53.google.com ([209.85.215.53]:36035 "EHLO mail-la0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965298AbbDVQO1 (ORCPT ); Wed, 22 Apr 2015 12:14:27 -0400 From: Ricardo Ribalda Delgado To: Greg Kroah-Hartman , Grant Likely , Rob Herring , Andrew Morton , Jakub Sitnicki , Vivek Goyal , Bjorn Helgaas , Jiang Liu , Mike Travis , Thierry Reding , linux-kernel@vger.kernel.org, devicetree@vger.kernel.org Cc: Ricardo Ribalda Delgado Subject: [PATCH v3 1/4] kernel/resource: Invalid memory access in __release_resource Date: Wed, 22 Apr 2015 18:14:18 +0200 Message-Id: <1429719261-18024-2-git-send-email-ricardo.ribalda@gmail.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1429719261-18024-1-git-send-email-ricardo.ribalda@gmail.com> References: <1429719261-18024-1-git-send-email-ricardo.ribalda@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1330 Lines: 43 When a resource is initialized via of_platform_populate. resource->parent is initialized to NULL via kzalloc. (of_platform_populate->of_device_alloc->of_address_to_resource) If of_platform_depopulate is called later, resource->parent is accessed (Offset 0x30 of address 0), causing a kernel error. This patch evaluates resouce->parent before accessing it. If it is not initialized, -EACCESS is returned. Also a WARN is thrown, so the developer can have a hint about what needs to be fixed. Fixes: BUG: unable to handle kernel NULL pointer deference at 0000000000000030 IP: release_resource+0x26/0x90 Signed-off-by: Ricardo Ribalda Delgado --- kernel/resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/resource.c b/kernel/resource.c index 90552aa..b7b270f 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -237,6 +237,9 @@ static int __release_resource(struct resource *old) { struct resource *tmp, **p; + if (WARN_ON(!old->parent)) + return -EINVAL; + p = &old->parent->child; for (;;) { tmp = *p; -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/