| Message ID | 20221110082056.2014898-1-zengheng4@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map | expand |
On Thu, Nov 10, 2022 at 9:22 AM Zeng Heng <zengheng4@huawei.com> wrote: > Here is the BUG report by KASAN about null pointer dereference: > > BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 > Read of size 1 at addr 0000000000000000 by task python3/2640 > Call Trace: > strcmp > __of_find_property > of_find_property > pinctrl_dt_to_map > > kasprintf() would return NULL pointer when kmalloc() fail to allocate. > So directly return ENOMEM, if kasprintf() return NULL pointer. > > Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support") > Signed-off-by: Zeng Heng <zengheng4@huawei.com> Patch applied for fixes. Interesting that you managed to locate this using *kasan* of all things, it kind of requires that you manage to run out of memory exactly at this time... Yours, Linus Walleij
On 2022/11/10 19:27, Linus Walleij wrote: > On Thu, Nov 10, 2022 at 9:22 AM Zeng Heng <zengheng4@huawei.com> wrote: > >> Here is the BUG report by KASAN about null pointer dereference: >> >> BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 >> Read of size 1 at addr 0000000000000000 by task python3/2640 >> Call Trace: >> strcmp >> __of_find_property >> of_find_property >> pinctrl_dt_to_map >> >> kasprintf() would return NULL pointer when kmalloc() fail to allocate. >> So directly return ENOMEM, if kasprintf() return NULL pointer. >> >> Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support") >> Signed-off-by: Zeng Heng <zengheng4@huawei.com> > Patch applied for fixes. > > Interesting that you managed to locate this using *kasan* of all > things, it kind of requires that you manage to run out of memory > exactly at this time... > > Yours, > Linus Walleij yes, actually it runs with *kasan* & companied with fault-inject into every single time. Best regards, Zeng Heng
On Thu, Nov 10, 2022 at 1:05 PM Zeng Heng <zengheng4@huawei.com> wrote: > On 2022/11/10 19:27, Linus Walleij wrote: > > On Thu, Nov 10, 2022 at 9:22 AM Zeng Heng <zengheng4@huawei.com> wrote: > > > >> Here is the BUG report by KASAN about null pointer dereference: > >> > >> BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 > >> Read of size 1 at addr 0000000000000000 by task python3/2640 > >> Call Trace: > >> strcmp > >> __of_find_property > >> of_find_property > >> pinctrl_dt_to_map > >> > >> kasprintf() would return NULL pointer when kmalloc() fail to allocate. > >> So directly return ENOMEM, if kasprintf() return NULL pointer. > >> > >> Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support") > >> Signed-off-by: Zeng Heng <zengheng4@huawei.com> > > Patch applied for fixes. > > > > Interesting that you managed to locate this using *kasan* of all > > things, it kind of requires that you manage to run out of memory > > exactly at this time... > > > > Yours, > > Linus Walleij > > yes, actually it runs with *kasan* & companied with fault-inject into > every single time. Aha! That's a neat trick. Thanks for doing this! Yours, Linus Walleij
diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c index ef898ee8ca6b..6e0a40962f38 100644 --- a/drivers/pinctrl/devicetree.c +++ b/drivers/pinctrl/devicetree.c @@ -220,6 +220,8 @@ int pinctrl_dt_to_map(struct pinctrl *p, struct pinctrl_dev *pctldev) for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); + if (!propname) + return -ENOMEM; prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) {
Here is the BUG report by KASAN about null pointer dereference: BUG: KASAN: null-ptr-deref in strcmp+0x2e/0x50 Read of size 1 at addr 0000000000000000 by task python3/2640 Call Trace: strcmp __of_find_property of_find_property pinctrl_dt_to_map kasprintf() would return NULL pointer when kmalloc() fail to allocate. So directly return ENOMEM, if kasprintf() return NULL pointer. Fixes: 57291ce295c0 ("pinctrl: core device tree mapping table parsing support") Signed-off-by: Zeng Heng <zengheng4@huawei.com> --- drivers/pinctrl/devicetree.c | 2 ++ 1 file changed, 2 insertions(+)