[PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

Subsystems: input (keyboard, mouse, joystick, touchscreen) drivers, the rest

STALE5130d REVIEWED: 1 (0M)

1 review trailer.

5 messages, 4 authors, 2012-08-17 · open the first message on its own page

[PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

From: Fabio Estevam <hidden>
Date: 2012-08-03 13:42:03 

Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser) 
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];' 
returning a NULL pointer, and then 'button' was accessed afterwards 
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL 
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
Acked-by: Alexandre Pereira da Silva <redacted>
---
 drivers/input/keyboard/gpio_keys.c |   16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6ee68ec..620ef24 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -559,7 +559,6 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 	struct gpio_keys_button *button;
 	int error;
 	int nbuttons;
-	int i;
 
 	node = dev->of_node;
 	if (!node) {
@@ -580,9 +579,11 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 		goto err_out;
 	}
 
+	pdata->buttons = (struct gpio_keys_button *) (pdata + 1);
+	pdata->nbuttons = nbuttons;
+
 	pdata->rep = !!of_get_property(node, "autorepeat", NULL);
 
-	i = 0;
 	for_each_child_of_node(node, pp) {
 		enum of_gpio_flags flags;
 
@@ -592,8 +593,13 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 			continue;
 		}
 
-		button = &pdata->buttons[i++];
-
+		button = pdata->buttons;
+
+		if (!button)	{
+			error = -ENOMEM;
+			goto err_free_pdata;
+		}
+
 		button->gpio = of_get_gpio_flags(pp, 0, &flags);
 		button->active_low = flags & OF_GPIO_ACTIVE_LOW;
 
@@ -614,6 +620,8 @@ gpio_keys_get_devtree_pdata(struct device *dev)
 		if (of_property_read_u32(pp, "debounce-interval",
 					 &button->debounce_interval))
 			button->debounce_interval = 5;
+
+		button++;
 	}
 
 	if (pdata->nbuttons == 0) {
-- 
1.7.1

Re: [PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

From: Shubhrajyoti <hidden>
Date: 2012-08-06 08:50:52 

On Friday 03 August 2012 07:11 PM, Fabio Estevam wrote:
Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser) 
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];' 
returning a NULL pointer, and then 'button' was accessed afterwards 
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL 
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
Acked-by: Alexandre Pereira da Silva <redacted>
Should we cc stable?

Re: [PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: 2012-08-06 15:20:42 

On Mon, Aug 06, 2012 at 02:20:27PM +0530, Shubhrajyoti wrote:
On Friday 03 August 2012 07:11 PM, Fabio Estevam wrote:
quoted
Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser) 
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];' 
returning a NULL pointer, and then 'button' was accessed afterwards 
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL 
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
Acked-by: Alexandre Pereira da Silva <redacted>
Should we cc stable?
No, because it hasn't hit mainline.

Thanks.

-- 
Dmitry

Re: [PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

From: Datta, Shubhrajyoti <hidden>
Date: 2012-08-06 17:39:54 

On Mon, Aug 6, 2012 at 1:50 PM, Dmitry Torokhov
[off-list ref] wrote:
On Mon, Aug 06, 2012 at 02:20:27PM +0530, Shubhrajyoti wrote:
quoted
On Friday 03 August 2012 07:11 PM, Fabio Estevam wrote:
quoted
Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser)
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];'
returning a NULL pointer, and then 'button' was accessed afterwards
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
Acked-by: Alexandre Pereira da Silva <redacted>
Should we cc stable?
No, because it hasn't hit mainline.
ops should have checked that.
thanks,

Thanks.

--
Dmitry

RE: [PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

From: Estevam Fabio-R49496 <hidden>
Date: 2012-08-17 00:02:50 

Dmitry,

Any comments about this patch? 
________________________________________
From: Estevam Fabio-R49496
Sent: Friday, August 03, 2012 8:41 AM
To: dmitry.torokhov@gmail.com
Cc: shawn.guo@linaro.org; kernel@pengutronix.de; aletes.xgr@gmail.com; rob.herring@calxeda.com; linux-input@vger.kernel.org; Estevam Fabio-R49496
Subject: [PATCH] Input: gpio_keys - fix NULL pointer dereference for dt case

Commit 30161f6b2e7d1 (Input: gpio_keys - clean up device tree parser)
introduced the following kernel crash for a dt based kernel:
..
Unable to handle kernel NULL pointer dereference at virtual address 00000004
pgd = 80004000
[00000004] *pgd=00000000
Internal error: Oops: 805 [#1] ARM
Modules linked in:
CPU: 0    Not tainted  (3.5.0-next-20120802+ #1366)
PC is at gpio_keys_probe+0x154/0x8c0
LR is at of_gpiochip_find_and_xlate+0x54/0x70
pc : [<803ddbac>]    lr : [<801ed2f4>]    psr: 60000013
sp : 9f851df8  ip : 00000002  fp : 9f851e5c
r10: 9f873d00  r9 : 00000001  r8 : 9fa2f900
r7 : 809c0920  r6 : 9f873d08  r5 : 00000000  r4 : 809c09d4
r3 : 805af10c  r2 : 000000c0  r1 : 9f851db4  r0 : 000000d5
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 90004019  DAC: 00000015
Process swapper (pid: 1, stack limit = 0x9f8502e8)
Stack: (0x9f851df8 to 0x9f852000)
....

The reason for the crash was due to 'button = &pdata->buttons[i++];'
returning a NULL pointer, and then 'button' was accessed afterwards
without checking for NULL.

Fix this by correctly assigning 'pdata->buttons' and also add a NULL
pointer check for 'button' pointer.

Signed-off-by: Fabio Estevam <redacted>
Acked-by: Alexandre Pereira da Silva <redacted>
---
 drivers/input/keyboard/gpio_keys.c |   16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6ee68ec..620ef24 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -559,7 +559,6 @@ gpio_keys_get_devtree_pdata(struct device *dev)
        struct gpio_keys_button *button;
        int error;
        int nbuttons;
-       int i;

        node = dev->of_node;
        if (!node) {
@@ -580,9 +579,11 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                goto err_out;
        }

+       pdata->buttons = (struct gpio_keys_button *) (pdata + 1);
+       pdata->nbuttons = nbuttons;
+
        pdata->rep = !!of_get_property(node, "autorepeat", NULL);

-       i = 0;
        for_each_child_of_node(node, pp) {
                enum of_gpio_flags flags;

@@ -592,8 +593,13 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                        continue;
                }

-               button = &pdata->buttons[i++];
-
+               button = pdata->buttons;
+
+               if (!button)    {
+                       error = -ENOMEM;
+                       goto err_free_pdata;
+               }
+
                button->gpio = of_get_gpio_flags(pp, 0, &flags);
                button->active_low = flags & OF_GPIO_ACTIVE_LOW;

@@ -614,6 +620,8 @@ gpio_keys_get_devtree_pdata(struct device *dev)
                if (of_property_read_u32(pp, "debounce-interval",
                                         &button->debounce_interval))
                        button->debounce_interval = 5;
+
+               button++;
        }

        if (pdata->nbuttons == 0) {
--
1.7.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help