Skip to contentSkip to conversation

thunderbolt: Prevent crash if non-active NVMem file is read

PATCH New Mika Westerberg 1 participant 1 message Feb 13, 2020

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 thunderbolt: Prevent crash if non-active NVMem file is read

The driver does not populate .reg_read callback for the non-active NVMem because the file is supposed to be write-only. However, it turns out NVMem subsystem does not yet support this and expects that the .reg_read callback is provided. If user reads the binary attribute it triggers NULL pointer dereference like this one:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  Call Trace:
   bin_attr_nvmem_read+0x64/0x80
   kernfs_fop_read+0xa7/0x180
   vfs_read+0xbd/0x170
   ksys_read+0x5a/0xd0
   do_syscall_64+0x43/0x150
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix this in the driver by providing .reg_read callback that always returns an error.

Fixes e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade")

---
Once NVMem subsystem starts supporting write-only NVMems we can drop this one.

 drivers/thunderbolt/switch.c | 7 +++++++
 1 file changed, 7 insertions(+)
drivers/thunderbolt/switch.c +7 -0
index ad5479f21174..7d6ecc342508 100644
@@ -348,6 +348,12 @@ static int tb_switch_nvm_read(void *priv, unsigned int offset, void *val,
 	return ret;
 }
 
+static int tb_switch_nvm_no_read(void *priv, unsigned int offset, void *val,
+				 size_t bytes)
+{
+	return -EPERM;
+}
+
 static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
 			       size_t bytes)
 {
@@ -393,6 +399,7 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id,
 		config.read_only = true;
 	} else {
 		config.name = "nvm_non_active";
+		config.reg_read = tb_switch_nvm_no_read;
 		config.reg_write = tb_switch_nvm_write;
 		config.root_only = true;
 	}
Signature · 1 line
2.25.0