lkml.org 
[lkml]   [2019]   [Apr]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.0 130/246] leds: lp55xx: fix null deref on firmware load failure
    Date
    5.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 5ddb0869bfc1bca6cfc592c74c64a026f936638c ]

    I've stumbled upon a kernel crash and the logs
    pointed me towards the lp5562 driver:

    > <4>[306013.841294] lp5562 0-0030: Direct firmware load for lp5562 failed with error -2
    > <4>[306013.894990] lp5562 0-0030: Falling back to user helper
    > ...
    > <3>[306073.924886] lp5562 0-0030: firmware request failed
    > <1>[306073.939456] Unable to handle kernel NULL pointer dereference at virtual address 00000000
    > <4>[306074.251011] PC is at _raw_spin_lock+0x1c/0x58
    > <4>[306074.255539] LR is at release_firmware+0x6c/0x138
    > ...

    After taking a look I noticed firmware_release()
    could be called with either NULL or a dangling
    pointer.

    Fixes: 10c06d178df11 ("leds-lp55xx: support firmware interface")
    Signed-off-by: Michal Kazior <michal@plume.com>
    Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/leds/leds-lp55xx-common.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
    index 3d79a6380761..723f2f17497a 100644
    --- a/drivers/leds/leds-lp55xx-common.c
    +++ b/drivers/leds/leds-lp55xx-common.c
    @@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)

    if (!fw) {
    dev_err(dev, "firmware request failed\n");
    - goto out;
    + return;
    }

    /* handling firmware data is chip dependent */
    @@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)

    mutex_unlock(&chip->lock);

    -out:
    /* firmware should be released for other channel use */
    release_firmware(chip->fw);
    + chip->fw = NULL;
    }

    static int lp55xx_request_firmware(struct lp55xx_chip *chip)
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-04-04 11:25    [W:2.381 / U:24.988 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site