Skip to content

Commit

Permalink
xrp-kernel: fix crash in initialization on x86 android
Browse files Browse the repository at this point in the history 
On x86 android both OF and ACPI may be enabled, but only ACPI
configuration may be provided by the system, resulting in NULL pointer
returned from of_match_device and subsequent crash on attempt to extract
of_device_id::data.
Don't continue OF initialization when no match is found.
This fixes the following crash on x86 android:

  BUG: unable to handle kernel NULL pointer dereference at 00000000b85849e0
  IP: xrp_probe+0x26/0x3e
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  Modules linked in:
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.14.112+ #3
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014
  task: 0000000058347fc4 task.stack: 00000000ee3e845e
  RIP: 0010:xrp_probe+0x26/0x3e
  RSP: 0000:ffffb1438000bd40 EFLAGS: 00010246
  RAX: 0000000000000000 RBX: ffff95f42ef11000 RCX: 0000000000000000
  RDX: ffffffff85aa0a40 RSI: 0000000000000000 RDI: ffff95f42ef11000
  RBP: ffffb1438000bd48 R08: ffff95f42ecc0000 R09: ffff95f42eda5010
  R10: ffff95f42eda7840 R11: 0000000000000044 R12: ffffffff85e93348
  R13: 0000000000000000 R14: ffffffff85e93348 R15: 0000000000000000
  FS:  0000000000000000(0000) GS:ffff95f43fd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000000000c0 CR3: 000000001fe0e000 CR4: 00000000000006a0
  Call Trace:
   platform_drv_probe+0x4a/0x8d
   driver_probe_device+0x121/0x27d
   __driver_attach+0x6a/0x8c
   ? driver_probe_device+0x27d/0x27d
   bus_for_each_dev+0x74/0xa2
   driver_attach+0x19/0x1b
   bus_add_driver+0xee/0x1d5
   ? set_debug_rodata+0x12/0x12
   driver_register+0x83/0xba
   ? goldfish_address_space_driver_init+0x1b/0x1b
   __platform_driver_register+0x31/0x33
   xrp_driver_init+0x12/0x14
   do_one_initcall+0x9a/0x151
   ? loglevel+0x42/0x54
   ? set_debug_rodata+0x12/0x12
   kernel_init_freeable+0x163/0x1eb
   ? rest_init+0xc1/0xc1
   kernel_init+0x9/0xeb
   ret_from_fork+0x1f/0x30
  Code: c3 83 e0 01 c3 55 48 8d 77 10 48 89 e5 53 48 89 fb 48 c7 c7 20 07 aa 85 e8 ce 89 10 00 31 c9 48 c7 c2 40 0a aa 85 31 f6 48 89 df <ff> 90 c0 00 00 00 ba 00 00 00 00 5b 48 3d 00 f0 ff ff 5d 48 0f
  RIP: xrp_probe+0x26/0x3e RSP: ffffb1438000bd40
  CR2: 00000000000000c0

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
  • Loading branch information
@jcmvbkbc
jcmvbkbc committed Oct 3, 2019
1 parent 407e61d commit 30a7640
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions xrp-kernel/xvp_main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2244,14 +2244,16 @@ static int xrp_probe(struct platform_device *pdev)
long ret = -EINVAL;

#ifdef CONFIG_OF
{
const struct of_device_id *match;
xrp_init_function *init;
const struct of_device_id *match;

match = of_match_device(xrp_of_match, &pdev->dev);
if (match) {
xrp_init_function *init = match->data;

match = of_match_device(xrp_of_match, &pdev->dev);
init = match->data;
ret = init(pdev, 0, &hw_ops, NULL);
return IS_ERR_VALUE(ret) ? ret : 0;
} else {
pr_debug("%s: no OF device match found\n", __func__);
}
#endif
#ifdef CONFIG_ACPI
Expand Down

0 comments on commit 30a7640

Please sign in to comment.