Received: by 10.223.185.116 with SMTP id b49csp4182140wrg; Mon, 26 Feb 2018 12:42:49 -0800 (PST) X-Google-Smtp-Source: AH8x22796FB1mENsBGQXWrN+8JELRNo6MpV6jcvJ8JT6SPj+fICIyfoRk8eF3J9GHk5Xz4OtO0kR X-Received: by 2002:a17:902:b901:: with SMTP id bf1-v6mr11903652plb.175.1519677769148; Mon, 26 Feb 2018 12:42:49 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519677769; cv=none; d=google.com; s=arc-20160816; b=RRow8Mc35aY746H6kqtoVV200a2hL3V00eUoOMttUc/Wcu69csTC8uhXgUORDDGWIH SxxOgNTQGlLgdgmfbaApDDyl18CzUErGoPJmFG6l6E9Sdoi4XESBDUwjPBR2CDekNaQL PbwKXhCjA4HnEjrkGrk3M6oQLet9Iv7GcfM01P6Yb7st60w8JzygMrJ9CFO72gge7v9V PJ0Ai8uhCffm0zEBxNe5xqIVvnUtU5hRWp1F2bwppOrM6iBbXc4uBf2fzLaXGblycdCL fc6PQYELwAXzmXw90p2QYnnXvCj4KoS+JvWyAOTMkOGLBwgJSod40gru36QFCaH+a9X2 yiTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=Eb5zzIY9dUWDuFl0YukBCHo811JrgQCJZTVTFwV+l9k=; b=cLgvearWSHEM4YhuSUZoxgqCqHQJ0TFa91nNY36vnWP83qHMU3W2XTPBU3/rDslzum qAwKhlTx89/HF4B2ns5Hg7MrbB3yZG7PXaaofbT+4zM5NMbqnxgC39EgUVvv1zn1um6e qX/NNRQ+oZWptDRAd+PWy4S3K+kTXv/cBF70DEEbDjqlaQR3qKCjHucBrmCy4PfJ6t+T EBynwgVICHartQjnI6pDSLJh2p7KStYe6sgenFBu6Bm0ijZJVanf0ONuyH4Iv8ICKHxY kgE+6EN5keN2qWdb6IxVzHO+6ycEfu6uQdercKVWUegedY/+V23NdubZZAkCmgqsYwad ucHw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 37-v6si862879plq.451.2018.02.26.12.42.33; Mon, 26 Feb 2018 12:42:49 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753594AbeBZU1D (ORCPT + 99 others); Mon, 26 Feb 2018 15:27:03 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:36138 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753578AbeBZU07 (ORCPT ); Mon, 26 Feb 2018 15:26:59 -0500 Received: from localhost (clnet-b04-243.ikbnet.co.at [83.175.124.243]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 26EBACC3; Mon, 26 Feb 2018 20:26:57 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robin Getz , Lars-Peter Clausen , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.15 25/64] iio: adis_lib: Initialize trigger before requesting interrupt Date: Mon, 26 Feb 2018 21:22:02 +0100 Message-Id: <20180226202154.540694031@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180226202153.453363333@linuxfoundation.org> References: <20180226202153.453363333@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Lars-Peter Clausen commit f027e0b3a774e10302207e91d304bbf99e3a8b36 upstream. The adis_probe_trigger() creates a new IIO trigger and requests an interrupt associated with the trigger. The interrupt uses the generic iio_trigger_generic_data_rdy_poll() function as its interrupt handler. Currently the driver initializes some fields of the trigger structure after the interrupt has been requested. But an interrupt can fire as soon as it has been requested. This opens up a race condition. iio_trigger_generic_data_rdy_poll() will access the trigger data structure and dereference the ops field. If the ops field is not yet initialized this will result in a NULL pointer deref. It is not expected that the device generates an interrupt at this point, so typically this issue did not surface unless e.g. due to a hardware misconfiguration (wrong interrupt number, wrong polarity, etc.). But some newer devices from the ADIS family start to generate periodic interrupts in their power-on reset configuration and unfortunately the interrupt can not be masked in the device. This makes the race condition much more visible and the following crash has been observed occasionally when booting a system using the ADIS16460. Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = c0004000 [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.0-04126-gf9739f0-dirty #257 Hardware name: Xilinx Zynq Platform task: ef04f640 task.stack: ef050000 PC is at iio_trigger_notify_done+0x30/0x68 LR is at iio_trigger_generic_data_rdy_poll+0x18/0x20 pc : [] lr : [] psr: 60000193 sp : ef051bb8 ip : 00000000 fp : ef106400 r10: c081d80a r9 : ef3bfa00 r8 : 00000087 r7 : ef051bec r6 : 00000000 r5 : ef3bfa00 r4 : ee92ab00 r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : ee97e400 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none Control: 18c5387d Table: 0000404a DAC: 00000051 Process swapper/0 (pid: 1, stack limit = 0xef050210) [] (iio_trigger_notify_done) from [] (__handle_irq_event_percpu+0x88/0x118) [] (__handle_irq_event_percpu) from [] (handle_irq_event_percpu+0x1c/0x58) [] (handle_irq_event_percpu) from [] (handle_irq_event+0x38/0x5c) [] (handle_irq_event) from [] (handle_level_irq+0xa4/0x130) [] (handle_level_irq) from [] (generic_handle_irq+0x24/0x34) [] (generic_handle_irq) from [] (zynq_gpio_irqhandler+0xb8/0x13c) [] (zynq_gpio_irqhandler) from [] (generic_handle_irq+0x24/0x34) [] (generic_handle_irq) from [] (__handle_domain_irq+0x5c/0xb4) [] (__handle_domain_irq) from [] (gic_handle_irq+0x48/0x8c) [] (gic_handle_irq) from [] (__irq_svc+0x6c/0xa8) To fix this make sure that the trigger is fully initialized before requesting the interrupt. Fixes: ccd2b52f4ac6 ("staging:iio: Add common ADIS library") Reported-by: Robin Getz Signed-off-by: Lars-Peter Clausen Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/imu/adis_trigger.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/iio/imu/adis_trigger.c +++ b/drivers/iio/imu/adis_trigger.c @@ -46,6 +46,10 @@ int adis_probe_trigger(struct adis *adis if (adis->trig == NULL) return -ENOMEM; + adis->trig->dev.parent = &adis->spi->dev; + adis->trig->ops = &adis_trigger_ops; + iio_trigger_set_drvdata(adis->trig, adis); + ret = request_irq(adis->spi->irq, &iio_trigger_generic_data_rdy_poll, IRQF_TRIGGER_RISING, @@ -54,9 +58,6 @@ int adis_probe_trigger(struct adis *adis if (ret) goto error_free_trig; - adis->trig->dev.parent = &adis->spi->dev; - adis->trig->ops = &adis_trigger_ops; - iio_trigger_set_drvdata(adis->trig, adis); ret = iio_trigger_register(adis->trig); indio_dev->trig = iio_trigger_get(adis->trig);