Patchwork [1/2] mtd: gpmi: fix the NULL pointer

login
register
mail settings
Submitter Huang Shijie
Date Nov. 7, 2013, 9:46 a.m.
Message ID <1383817597-31992-1-git-send-email-b32955@freescale.com>
Download mbox | patch
Permalink /patch/289252/
State New
Headers show

Comments

Huang Shijie - Nov. 7, 2013, 9:46 a.m.
The imx23 board will check the fingerprint, so it will call the
mx23_check_transcription_stamp. This function will use @chip->buffers->databuf
as its buffer which is allocated in the nand_scan_tail().

Unfortunately, the mx23_check_transcription_stamp is called before the
nand_scan_tail(). So we will meet a NULL pointer bug:

--------------------------------------------------------------------
[    1.150000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xd7 (Samsung NAND 4GiB 3,3V 8-bit), 4096MiB, page size: 4096, OOB size: 8
[    1.160000] Unable to handle kernel NULL pointer dereference at virtual address 000005d0
[    1.170000] pgd = c0004000
[    1.170000] [000005d0] *pgd=00000000
[    1.180000] Internal error: Oops: 5 [#1] ARM
[    1.180000] Modules linked in:
[    1.180000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0 #89
[    1.180000] task: c7440000 ti: c743a000 task.ti: c743a000
[    1.180000] PC is at memcmp+0x10/0x54
[    1.180000] LR is at gpmi_nand_probe+0x42c/0x894
[    1.180000] pc : [<c025fcb0>]    lr : [<c02f6a68>]    psr: 20000053
[    1.180000] sp : c743be2c  ip : 600000d3  fp : ffffffff
[    1.180000] r10: 000005d0  r9 : c02f5f08  r8 : 00000000
[    1.180000] r7 : c75858a8  r6 : c75858a8  r5 : c7585b18  r4 : c7585800
[    1.180000] r3 : 000005d0  r2 : 00000004  r1 : c05c33e4  r0 : 000005d0
[    1.180000] Flags: nzCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
[    1.180000] Control: 0005317f  Table: 40004000  DAC: 00000017
[    1.180000] Process swapper (pid: 1, stack limit = 0xc743a1c0)
--------------------------------------------------------------------

This patch uses the local array(whose size is 4 bytes) to replace
the referencing of the @chip->buffers->databuf.

Use the macro FINGERPRINT_LEN to avoid the hardcode.

Cc: stable@vger.kernel.org 
Reported-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Huang Shijie <b32955@freescale.com>
---
 drivers/mtd/nand/gpmi-nand/gpmi-nand.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
Fabio Estevam - Nov. 7, 2013, 1:07 p.m.
Hi Huang,

On Thu, Nov 7, 2013 at 7:46 AM, Huang Shijie <b32955@freescale.com> wrote:
> The imx23 board will check the fingerprint, so it will call the
> mx23_check_transcription_stamp. This function will use @chip->buffers->databuf
> as its buffer which is allocated in the nand_scan_tail().
>
> Unfortunately, the mx23_check_transcription_stamp is called before the
> nand_scan_tail(). So we will meet a NULL pointer bug:
>
> --------------------------------------------------------------------
> [    1.150000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xd7 (Samsung NAND 4GiB 3,3V 8-bit), 4096MiB, page size: 4096, OOB size: 8
> [    1.160000] Unable to handle kernel NULL pointer dereference at virtual address 000005d0
> [    1.170000] pgd = c0004000
> [    1.170000] [000005d0] *pgd=00000000
> [    1.180000] Internal error: Oops: 5 [#1] ARM
> [    1.180000] Modules linked in:
> [    1.180000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0 #89
> [    1.180000] task: c7440000 ti: c743a000 task.ti: c743a000
> [    1.180000] PC is at memcmp+0x10/0x54
> [    1.180000] LR is at gpmi_nand_probe+0x42c/0x894
> [    1.180000] pc : [<c025fcb0>]    lr : [<c02f6a68>]    psr: 20000053
> [    1.180000] sp : c743be2c  ip : 600000d3  fp : ffffffff
> [    1.180000] r10: 000005d0  r9 : c02f5f08  r8 : 00000000
> [    1.180000] r7 : c75858a8  r6 : c75858a8  r5 : c7585b18  r4 : c7585800
> [    1.180000] r3 : 000005d0  r2 : 00000004  r1 : c05c33e4  r0 : 000005d0
> [    1.180000] Flags: nzCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
> [    1.180000] Control: 0005317f  Table: 40004000  DAC: 00000017
> [    1.180000] Process swapper (pid: 1, stack limit = 0xc743a1c0)
> --------------------------------------------------------------------
>
> This patch uses the local array(whose size is 4 bytes) to replace
> the referencing of the @chip->buffers->databuf.
>
> Use the macro FINGERPRINT_LEN to avoid the hardcode.
>
> Cc: stable@vger.kernel.org
> Reported-by: Fabio Estevam <festevam@gmail.com>
> Signed-off-by: Huang Shijie <b32955@freescale.com>
> ---
>  drivers/mtd/nand/gpmi-nand/gpmi-nand.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> index 7ac2280..d34cc54 100644
> --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> @@ -1343,6 +1343,7 @@ static int nand_boot_set_geometry(struct gpmi_nand_data *this)
>  }
>
>  static const char  *fingerprint = "STMP";
> +#define FINGERPRINT_LEN                4
>  static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
>  {
>         struct boot_rom_geometry *rom_geo = &this->rom_geometry;
> @@ -1352,7 +1353,7 @@ static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
>         unsigned int search_area_size_in_strides;
>         unsigned int stride;
>         unsigned int page;
> -       uint8_t *buffer = chip->buffers->databuf;
> +       uint8_t buffer[FINGERPRINT_LEN + 1];

Why buffer[FINGERPRINT_LEN + 1] instead of buffer[FINGERPRINT_LEN] ?

Regards,

Fabio Estevam
Huang Shijie - Nov. 8, 2013, 3:10 a.m.
于 2013年11月07日 21:07, Fabio Estevam 写道:
> Why buffer[FINGERPRINT_LEN + 1] instead of buffer[FINGERPRINT_LEN] ?
just for the safe guard. "+1" is to simulate the terminal '\0' of the 
string.
Of course, it's ok to use the buffer[FINGERPINGT_LEN].

thanks
Huang Shijie
Fabio Estevam - Nov. 8, 2013, 12:49 p.m.
On Fri, Nov 8, 2013 at 1:10 AM, Huang Shijie <b32955@freescale.com> wrote:
> 于 2013年11月07日 21:07, Fabio Estevam 写道:
>
>> Why buffer[FINGERPRINT_LEN + 1] instead of buffer[FINGERPRINT_LEN] ?
>
> just for the safe guard. "+1" is to simulate the terminal '\0' of the
> string.
> Of course, it's ok to use the buffer[FINGERPINGT_LEN].

Then please send a v2 without the +1. Let's save one byte ;-)

Regards,

Fabio Estevam
Brian Norris - Nov. 8, 2013, 5:51 p.m.
On Thu, Nov 07, 2013 at 05:46:36PM +0800, Huang Shijie wrote:
> The imx23 board will check the fingerprint, so it will call the
> mx23_check_transcription_stamp. This function will use @chip->buffers->databuf
> as its buffer which is allocated in the nand_scan_tail().
> 
> Unfortunately, the mx23_check_transcription_stamp is called before the
> nand_scan_tail(). So we will meet a NULL pointer bug:
> 
> --------------------------------------------------------------------
> [    1.150000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xd7 (Samsung NAND 4GiB 3,3V 8-bit), 4096MiB, page size: 4096, OOB size: 8
> [    1.160000] Unable to handle kernel NULL pointer dereference at virtual address 000005d0
> [    1.170000] pgd = c0004000
> [    1.170000] [000005d0] *pgd=00000000
> [    1.180000] Internal error: Oops: 5 [#1] ARM
> [    1.180000] Modules linked in:
> [    1.180000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0 #89
> [    1.180000] task: c7440000 ti: c743a000 task.ti: c743a000
> [    1.180000] PC is at memcmp+0x10/0x54
> [    1.180000] LR is at gpmi_nand_probe+0x42c/0x894
> [    1.180000] pc : [<c025fcb0>]    lr : [<c02f6a68>]    psr: 20000053
> [    1.180000] sp : c743be2c  ip : 600000d3  fp : ffffffff
> [    1.180000] r10: 000005d0  r9 : c02f5f08  r8 : 00000000
> [    1.180000] r7 : c75858a8  r6 : c75858a8  r5 : c7585b18  r4 : c7585800
> [    1.180000] r3 : 000005d0  r2 : 00000004  r1 : c05c33e4  r0 : 000005d0
> [    1.180000] Flags: nzCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment kernel
> [    1.180000] Control: 0005317f  Table: 40004000  DAC: 00000017
> [    1.180000] Process swapper (pid: 1, stack limit = 0xc743a1c0)
> --------------------------------------------------------------------
> 
> This patch uses the local array(whose size is 4 bytes) to replace
> the referencing of the @chip->buffers->databuf.
> 
> Use the macro FINGERPRINT_LEN to avoid the hardcode.
> 
> Cc: stable@vger.kernel.org 

This is only for 3.12+, right, since we changed around the
nand_scan_tail() behavior? (commit
f720e7ce510bf79f029be45ce200ccfce5551280)

> Reported-by: Fabio Estevam <festevam@gmail.com>
> Signed-off-by: Huang Shijie <b32955@freescale.com>
> ---
>  drivers/mtd/nand/gpmi-nand/gpmi-nand.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> index 7ac2280..d34cc54 100644
> --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
> @@ -1343,6 +1343,7 @@ static int nand_boot_set_geometry(struct gpmi_nand_data *this)
>  }
>  
>  static const char  *fingerprint = "STMP";
> +#define FINGERPRINT_LEN		4
>  static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
>  {
>  	struct boot_rom_geometry *rom_geo = &this->rom_geometry;
> @@ -1352,7 +1353,7 @@ static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
>  	unsigned int search_area_size_in_strides;
>  	unsigned int stride;
>  	unsigned int page;
> -	uint8_t *buffer = chip->buffers->databuf;
> +	uint8_t buffer[FINGERPRINT_LEN + 1];

I agree with Fabio; we don't actually need the +1. (Of course, saving 1
byte is not that much of a problem. But making the code more
straightforward is.) If you "ack" I'll just drop the +1 myself.

>  	int saved_chip_number;
>  	int found_an_ncb_fingerprint = false;
>  

Thanks for looking into this quickly, BTW.

Brian
Fabio Estevam - Nov. 8, 2013, 9:01 p.m.
On Fri, Nov 8, 2013 at 3:51 PM, Brian Norris
<computersforpeace@gmail.com> wrote:

> I agree with Fabio; we don't actually need the +1. (Of course, saving 1
> byte is not that much of a problem. But making the code more
> straightforward is.) If you "ack" I'll just drop the +1 myself.

You can also add my:

Tested-by: Fabio Estevam <fabio.estevam@freescale.com>

Thanks,

Fabio Estevam
Huang Shijie - Nov. 9, 2013, 6:10 p.m.
On Fri, Nov 08, 2013 at 09:51:19AM -0800, Brian Norris wrote:
> 
> I agree with Fabio; we don't actually need the +1. (Of course, saving 1
> byte is not that much of a problem. But making the code more
> straightforward is.) If you "ack" I'll just drop the +1 myself.
it is ok to me.

You can drop the +1 yourself.

thanks
Huang Shijie
Huang Shijie - Nov. 11, 2013, 9:30 a.m.
于 2013年11月09日 01:51, Brian Norris 写道:
> Thanks for looking into this quickly, BTW.
this patch is not good, it uses the data in the stack to do the DMA 
transfer.

I will send a new patch to fix this NULL issue.

thanks
Huang Shijie

Patch

diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index 7ac2280..d34cc54 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -1343,6 +1343,7 @@  static int nand_boot_set_geometry(struct gpmi_nand_data *this)
 }
 
 static const char  *fingerprint = "STMP";
+#define FINGERPRINT_LEN		4
 static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
 {
 	struct boot_rom_geometry *rom_geo = &this->rom_geometry;
@@ -1352,7 +1353,7 @@  static int mx23_check_transcription_stamp(struct gpmi_nand_data *this)
 	unsigned int search_area_size_in_strides;
 	unsigned int stride;
 	unsigned int page;
-	uint8_t *buffer = chip->buffers->databuf;
+	uint8_t buffer[FINGERPRINT_LEN + 1];
 	int saved_chip_number;
 	int found_an_ncb_fingerprint = false;