• Sudeep Holla's avatar
    coresight: access conn->child_name only if it's initialised · b8392153
    Sudeep Holla authored
    If the addition of the coresight devices get deferred, then there's a
    window before child_name is populated by of_get_coresight_platform_data
    from the respective component driver's probe and the attempted to access
    the same from coresight_orphan_match resulting in kernel NULL pointer
    dereference as below:
    
    Unable to handle kernel NULL pointer dereference at virtual address 0x0
    Internal error: Oops: 96000004 [#1] PREEMPT SMP
    Modules linked in:
    CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124
    Hardware name: ARM Juno development board (r2) (DT)
    Workqueue: events amba_deferred_retry_func
    PC is at strcmp+0x1c/0x160
    LR is at coresight_orphan_match+0x7c/0xd0
    Call trace:
     strcmp+0x1c/0x160
     bus_for_each_dev+0x60/0xa0
     coresight_register+0x264/0x2e0
     tmc_probe+0x130/0x310
     amba_probe+0xd4/0x1c8
     driver_probe_device+0x22c/0x418
     __device_attach_driver+0xbc/0x158
     bus_for_each_drv+0x58/0x98
     __device_attach+0xc4/0x160
     device_initial_probe+0x10/0x18
     bus_probe_device+0x94/0xa0
     device_add+0x344/0x580
     amba_device_try_add+0x194/0x238
     amba_deferred_retry_func+0x48/0xd0
     process_one_work+0x118/0x378
     worker_thread+0x48/0x498
     kthread+0xd0/0xe8
     ret_from_fork+0x10/0x40
    
    This patch adds a check for non-NULL conn->child_name before accessing
    the same.
    
    Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
    Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
    Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    b8392153
coresight.c 22.3 KB