Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 4 Feb 2022 16:02:11 +0900
From:   William Breathitt Gray <vilhelm.gray@gmail.com>
To:     Oleksij Rempel <o.rempel@pengutronix.de>
Cc:     linux-kernel@vger.kernel.org,
        Pengutronix Kernel Team <kernel@pengutronix.de>,
        David Jander <david@protonic.nl>,
        Robin van der Gracht <robin@protonic.nl>,
        linux-iio@vger.kernel.org, Jonathan Cameron <jic23@kernel.org>,
        u.kleine-koenig@pengutronix.de
Subject: Re: [PATCH v1] counter: fix NULL pointer dereference on
 counter_comp_u8_store()
Message-ID: <YfzPcyusGwAOkys6@shinobu>
References: <20220203135418.2252624-1-o.rempel@pengutronix.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="npq/AMq6ayJbuCXa"
Content-Disposition: inline
In-Reply-To: <20220203135418.2252624-1-o.rempel@pengutronix.de>
Precedence: bulk


--npq/AMq6ayJbuCXa
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 03, 2022 at 02:54:18PM +0100, Oleksij Rempel wrote:
> Current kernel will report NULL pointer dereference with following
> back trace:
>   interrupt_cnt_enable_write from counter_comp_u8_store+0xc0/0xf4
>   counter_comp_u8_store from dev_attr_store+0x24/0x30
>   dev_attr_store from sysfs_kf_write+0x48/0x54
>   sysfs_kf_write from kernfs_fop_write_iter+0x128/0x1c8
>   kernfs_fop_write_iter from vfs_write+0x124/0x1b4
>   vfs_write from ksys_write+0x88/0xe0
>   ksys_write from sys_write+0x18/0x1c
>   sys_write from ret_fast_syscall+0x0/0x1c
>=20
> Add missing dev_set_drvdata() to fix it.
>=20
> Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>

Hi Oleksij,

This dev_set_drvdata() was removed in commit b56346ddbd82 ("counter: Use
container_of instead of drvdata to track counter_device"). It looks like
we overlooked the counter-sysfs.c file when we made that change.

Would you instead replace the dev_get_drvdata() calls in counter-sysfs.c
with respective container_of() calls? Add a Fixes tag referencing commit
b56346ddbd82 as well to your commit message.

Thanks,

William Breathitt Gray

> ---
>  drivers/counter/counter-core.c | 2 ++
>  1 file changed, 2 insertions(+)
>=20
> diff --git a/drivers/counter/counter-core.c b/drivers/counter/counter-cor=
e.c
> index 7e0957eea094..1de16d5e9fbc 100644
> --- a/drivers/counter/counter-core.c
> +++ b/drivers/counter/counter-core.c
> @@ -98,6 +98,8 @@ struct counter_device *counter_alloc(size_t sizeof_priv)
>  	counter =3D &ch->counter;
>  	dev =3D &counter->dev;
> =20
> +	dev_set_drvdata(dev, counter);
> +
>  	/* Acquire unique ID */
>  	err =3D ida_alloc(&counter_ida, GFP_KERNEL);
>  	if (err < 0)
> --=20
> 2.30.2
>=20

--npq/AMq6ayJbuCXa
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEk5I4PDJ2w1cDf/bghvpINdm7VJIFAmH8z3MACgkQhvpINdm7
VJKlVg//fx7Qn6VlgplkBrbIHRkO/ZShnQ9i84RQhEEm7gBQ7Lwvcewrstj1imdR
IedgwHTYgctA1MVjrF6SS3fonTL1u5V6F751hIhZ66LqFvbHHPia2P7v773DFi29
Wo1keBwASGFZzUEpHudB1091x1iH7gZINsD46CKTzZ25c/HO+zQNeeAjFu96L7C9
ZdZZHvn+P7JRwP+WZu3sudWQEa34x/kbR7KI1xnybids3lzn0DRXcHNadfAjdxuL
9VseLn6JNBa8fxQ5WJ4kAD1Fck7Q6jnWXvmJeQYW6qGER5WGi42jWx5GyofLAHM4
dosyPm50GTMbil2gC7EZCf8cK7G0J2W/HtWmwOQl8wp39NJ14wejQh0sNhotd8IH
A2igsgxAKXPzjtOE59nU1pPdrBvQZOW3n7rJnVDNkp/SAwG8EI2TSTk4mpRLGEYy
v0QWUrZoeXxyzAqwvYZTn02SavUXqFYlBXO6JaYEUx6E00l4fyvK8rsbzIP9PLi/
beES5nqMZdCOmI7hiUOyqCphDnD517JfiyYCmcBCYJvZ5R1HBj2fZCk8sflEjuJl
/WDoBLDGC2nOfS1fpq5jk8eOJesqqHeNzDYwU0if/4xThm1xzgN0A58ZqzlPvPwB
Nd2GeHyVrqs1R/B6qm5iddZY78igxTzjMkt+zMBrrYLo8NhdJNg=
=9MuS
-----END PGP SIGNATURE-----

--npq/AMq6ayJbuCXa--