]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
thunderbolt: Prevent crash if non-active NVMem file is read
authorMika Westerberg <mika.westerberg@linux.intel.com>
Thu, 13 Feb 2020 09:56:04 +0000 (12:56 +0300)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 7 Apr 2020 08:50:28 +0000 (10:50 +0200)
commit4df65f60d2865823f48f402aaeaa182ead7e6c33
tree4aacd2c4e38dc7e38703bcf8a87421d540afe348
parentf1d195431a4f929103204ed2e6451a44cc452180
thunderbolt: Prevent crash if non-active NVMem file is read

BugLink: https://bugs.launchpad.net/bugs/1867837
commit 03cd45d2e219301880cabc357e3cf478a500080f upstream.

The driver does not populate .reg_read callback for the non-active NVMem
because the file is supposed to be write-only. However, it turns out
NVMem subsystem does not yet support this and expects that the .reg_read
callback is provided. If user reads the binary attribute it triggers
NULL pointer dereference like this one:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  Call Trace:
   bin_attr_nvmem_read+0x64/0x80
   kernfs_fop_read+0xa7/0x180
   vfs_read+0xbd/0x170
   ksys_read+0x5a/0xd0
   do_syscall_64+0x43/0x150
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix this in the driver by providing .reg_read callback that always
returns an error.

Reported-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade")
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200213095604.1074-1-mika.westerberg@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/thunderbolt/switch.c