LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH 1/3] Input: apanel: avoid panic if ioreamp fails
@ 2019-05-10  3:03 Kefeng Wang
  2019-05-10  3:03 ` [PATCH 2/3] Input: wistron_btns: " Kefeng Wang
  2019-05-10  3:03 ` [PATCH 3/3] i2c: i801: " Kefeng Wang
  0 siblings, 2 replies; 7+ messages in thread
From: Kefeng Wang @ 2019-05-10  3:03 UTC (permalink / raw)
  To: linux-kernel; +Cc: Kefeng Wang, Dmitry Torokhov, linux-input, Hulk Robot

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: linux-input@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/input/misc/apanel.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/misc/apanel.c b/drivers/input/misc/apanel.c
index c1e66f45d552..1c7262ad4b5b 100644
--- a/drivers/input/misc/apanel.c
+++ b/drivers/input/misc/apanel.c
@@ -259,7 +259,9 @@ static int __init apanel_init(void)
 	unsigned char i2c_addr;
 	int found = 0;
 
-	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
+	bios = ioremap(0xF0000, 0x10000);
+	if (!bios)
+		return -ENOMEM;
 
 	p = bios_signature(bios);
 	if (!p) {
-- 
2.20.1


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH 2/3] Input: wistron_btns: avoid panic if ioreamp fails
  2019-05-10  3:03 [PATCH 1/3] Input: apanel: avoid panic if ioreamp fails Kefeng Wang
@ 2019-05-10  3:03 ` Kefeng Wang
  2019-05-10  3:03 ` [PATCH 3/3] i2c: i801: " Kefeng Wang
  1 sibling, 0 replies; 7+ messages in thread
From: Kefeng Wang @ 2019-05-10  3:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Kefeng Wang, Dmitry Torokhov, Miloslav Trmac, Wolfram Sang,
	linux-input, Hulk Robot

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Miloslav Trmac <mitr@volny.cz>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-input@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/input/misc/wistron_btns.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 43e67f546366..a82ec3d102b4 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -107,7 +107,10 @@ static int __init map_bios(void)
 	ssize_t offset;
 	u32 entry_point;
 
-	base = ioremap(0xF0000, 0x10000); /* Can't fail */
+	base = ioremap(0xF0000, 0x10000);
+	if (!base)
+		return -ENOMEM;
+
 	offset = locate_wistron_bios(base);
 	if (offset < 0) {
 		printk(KERN_ERR "wistron_btns: BIOS entry point not found\n");
-- 
2.20.1


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails
  2019-05-10  3:03 [PATCH 1/3] Input: apanel: avoid panic if ioreamp fails Kefeng Wang
  2019-05-10  3:03 ` [PATCH 2/3] Input: wistron_btns: " Kefeng Wang
@ 2019-05-10  3:03 ` Kefeng Wang
  2019-05-10  8:09   ` Jean Delvare
  1 sibling, 1 reply; 7+ messages in thread
From: Kefeng Wang @ 2019-05-10  3:03 UTC (permalink / raw)
  To: linux-kernel
  Cc: Kefeng Wang, Jean Delvare, Wolfram Sang, linux-i2c, Hulk Robot

If ioremap fails, NULL pointer dereference will happen and
leading to a kernel panic when access the virtual address
in check_signature().

Fix it by check the return value of ioremap.

Cc: Jean Delvare <jdelvare@suse.com>
Cc: Wolfram Sang <wsa@the-dreams.de>
Cc: linux-i2c@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
 drivers/i2c/busses/i2c-i801.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 679c6c41f64b..fc6ccb8aba17 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
 	void __iomem *bios;
 	const void __iomem *p;
 
-	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
+	bios = ioremap(0xF0000, 0x10000);
+	if (!base)
+		return -ENOMEM;
+
 	p = bios_signature(bios);
 	if (p) {
 		/* just use the first address */
-- 
2.20.1


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails
  2019-05-10  3:03 ` [PATCH 3/3] i2c: i801: " Kefeng Wang
@ 2019-05-10  8:09   ` Jean Delvare
  2019-05-10  9:35     ` Kefeng Wang
  0 siblings, 1 reply; 7+ messages in thread
From: Jean Delvare @ 2019-05-10  8:09 UTC (permalink / raw)
  To: Kefeng Wang; +Cc: linux-kernel, Wolfram Sang, linux-i2c, Hulk Robot

Hi Kefeng,

On Fri, 10 May 2019 11:03:20 +0800, Kefeng Wang wrote:
> If ioremap fails, NULL pointer dereference will happen and
> leading to a kernel panic when access the virtual address
> in check_signature().
> 
> Fix it by check the return value of ioremap.
> 
> Cc: Jean Delvare <jdelvare@suse.com>
> Cc: Wolfram Sang <wsa@the-dreams.de>
> Cc: linux-i2c@vger.kernel.org
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
>  drivers/i2c/busses/i2c-i801.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
> index 679c6c41f64b..fc6ccb8aba17 100644
> --- a/drivers/i2c/busses/i2c-i801.c
> +++ b/drivers/i2c/busses/i2c-i801.c
> @@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
>  	void __iomem *bios;
>  	const void __iomem *p;
>  
> -	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
> +	bios = ioremap(0xF0000, 0x10000);
> +	if (!base)

That would be "if (!bios)". Please don't send patches without at least
test-building the result.

We don't need this anyway. The comment says it can't fail, so why
bother checking for a condition which will never happen?

> +		return -ENOMEM;
> +
>  	p = bios_signature(bios);
>  	if (p) {
>  		/* just use the first address */


-- 
Jean Delvare
SUSE L3 Support

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails
  2019-05-10  8:09   ` Jean Delvare
@ 2019-05-10  9:35     ` Kefeng Wang
  2019-05-10 12:18       ` Jean Delvare
  0 siblings, 1 reply; 7+ messages in thread
From: Kefeng Wang @ 2019-05-10  9:35 UTC (permalink / raw)
  To: Jean Delvare; +Cc: linux-kernel, Wolfram Sang, linux-i2c, Hulk Robot


On 2019/5/10 16:09, Jean Delvare wrote:
> Hi Kefeng,
>
> On Fri, 10 May 2019 11:03:20 +0800, Kefeng Wang wrote:
>> If ioremap fails, NULL pointer dereference will happen and
>> leading to a kernel panic when access the virtual address
>> in check_signature().
>>
>> Fix it by check the return value of ioremap.
>>
>> Cc: Jean Delvare <jdelvare@suse.com>
>> Cc: Wolfram Sang <wsa@the-dreams.de>
>> Cc: linux-i2c@vger.kernel.org
>> Reported-by: Hulk Robot <hulkci@huawei.com>
>> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
>> ---
>>  drivers/i2c/busses/i2c-i801.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
>> index 679c6c41f64b..fc6ccb8aba17 100644
>> --- a/drivers/i2c/busses/i2c-i801.c
>> +++ b/drivers/i2c/busses/i2c-i801.c
>> @@ -1068,7 +1068,10 @@ static void __init input_apanel_init(void)
>>  	void __iomem *bios;
>>  	const void __iomem *p;
>>  
>> -	bios = ioremap(0xF0000, 0x10000); /* Can't fail */
>> +	bios = ioremap(0xF0000, 0x10000);
>> +	if (!base)
> That would be "if (!bios)". Please don't send patches without at least
> test-building the result.
sorry,  copy error.

> We don't need this anyway. The comment says it can't fail, so why
> bother checking for a condition which will never happen?

The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)

find this issue.


>
>> +		return -ENOMEM;
>> +
>>  	p = bios_signature(bios);
>>  	if (p) {
>>  		/* just use the first address */
>


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails
  2019-05-10  9:35     ` Kefeng Wang
@ 2019-05-10 12:18       ` Jean Delvare
  2019-05-11  1:32         ` Kefeng Wang
  0 siblings, 1 reply; 7+ messages in thread
From: Jean Delvare @ 2019-05-10 12:18 UTC (permalink / raw)
  To: Kefeng Wang; +Cc: linux-kernel, Wolfram Sang, linux-i2c, Hulk Robot

On Fri, 10 May 2019 17:35:46 +0800, Kefeng Wang wrote:
> On 2019/5/10 16:09, Jean Delvare wrote:
> > We don't need this anyway. The comment says it can't fail, so why
> > bother checking for a condition which will never happen?  
> 
> The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)
> 
> find this issue.

The code only runs on x86 where this specific memory segment is
standardized for the purpose. That's how we know it "can't fail".

That being said, maybe it could fail for other reasons (internal kernel
bug, or bogus BIOS maybe), and I don't care adding the check
anyway, as this code path is not performance critical.

-- 
Jean Delvare
SUSE L3 Support

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH 3/3] i2c: i801: avoid panic if ioreamp fails
  2019-05-10 12:18       ` Jean Delvare
@ 2019-05-11  1:32         ` Kefeng Wang
  0 siblings, 0 replies; 7+ messages in thread
From: Kefeng Wang @ 2019-05-11  1:32 UTC (permalink / raw)
  To: Jean Delvare; +Cc: linux-kernel, Wolfram Sang, linux-i2c, Hulk Robot


On 2019/5/10 20:18, Jean Delvare wrote:
> On Fri, 10 May 2019 17:35:46 +0800, Kefeng Wang wrote:
>> On 2019/5/10 16:09, Jean Delvare wrote:
>>> We don't need this anyway. The comment says it can't fail, so why
>>> bother checking for a condition which will never happen?  
>> The ioremap could fails due to no memory, our inner test robot(enable FAULT_INJECTION)
>>
>> find this issue.
> The code only runs on x86 where this specific memory segment is
> standardized for the purpose. That's how we know it "can't fail".
>
> That being said, maybe it could fail for other reasons (internal kernel
> bug, or bogus BIOS maybe), and I don't care adding the check
> anyway, as this code path is not performance critical.
Got it , please ignore it.
>


^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2019-05-11  1:34 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-10  3:03 [PATCH 1/3] Input: apanel: avoid panic if ioreamp fails Kefeng Wang
2019-05-10  3:03 ` [PATCH 2/3] Input: wistron_btns: " Kefeng Wang
2019-05-10  3:03 ` [PATCH 3/3] i2c: i801: " Kefeng Wang
2019-05-10  8:09   ` Jean Delvare
2019-05-10  9:35     ` Kefeng Wang
2019-05-10 12:18       ` Jean Delvare
2019-05-11  1:32         ` Kefeng Wang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).