Skip to content
  • Lars-Peter Clausen's avatar
    staging:iio:ade7758: Fix NULL pointer deref when enabling buffer · e1055473
    Lars-Peter Clausen authored
    In older versions of the IIO framework it was possible to pass a completely
    different set of channels to iio_buffer_register() as the one that is
    assigned to the IIO device. Commit 959d2952 ("staging:iio: make
    iio_sw_buffer_preenable much more general.") introduced a restriction that
    requires that the set of channels that is passed to iio_buffer_register() is
    a subset of the channels assigned to the IIO device as the IIO core will use
    the list of channels that is assigned to the device to lookup a channel by
    scan index in iio_compute_scan_bytes(). If it can not find the channel the
    function will crash. This patch fixes the issue by making sure that the same
    set of channels is assigned to the IIO device and passed to
    iio_buffer_register().
    
    Note that we need to remove the IIO_CHAN_INFO_RAW and IIO_CHAN_INFO_SCALE
    info attributes from the channels since we don't actually want those to be
    registered.
    
    Fixes the following crash:
    	Unable to handle kernel NULL pointer dereference at virtual address 00000016
    	pgd = d2094000
    	[00000016] *pgd=16e39831, *pte=00000000, *ppte=00000000
    	Internal error: Oops: 17 [#1] PREEMPT SMP ARM
    	Modules linked in:
    	CPU: 1 PID: 1695 Comm: bash Not tainted 3.17.0-06329-g29461ee #9686
    	task: d7768040 ti: d5bd4000 task.ti: d5bd4000
    	PC is at iio_compute_scan_bytes+0x38/0xc0
    	LR is at iio_compute_scan_bytes+0x34/0xc0
    	pc : [<c0316de8>]    lr : [<c0316de4>]    psr: 60070013
    	sp : d5bd5ec0  ip : 00000000  fp : 00000000
    	r10: d769f934  r9 : 00000000  r8 : 00000001
    	r7 : 00000000  r6 : c8fc6240  r5 : d769f800  r4 : 00000000
    	r3 : d769f800  r2 : 00000000  r1 : ffffffff  r0 : 00000000
    	Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
    	Control: 18c5387d  Table: 1209404a  DAC: 00000015
    	Process bash (pid: 1695, stack limit = 0xd5bd4240)
    	Stack: (0xd5bd5ec0 to 0xd5bd6000)
    	5ec0: d769f800 d7435640 c8fc6240 d769f984 00000000 c03175a4 d7435690 d7435640
    	5ee0: d769f990 00000002 00000000 d769f800 d5bd4000 00000000 000b43a8 c03177f4
    	5f00: d769f810 0162b8c8 00000002 c8fc7e00 d77f1d08 d77f1da8 c8fc7e00 c01faf1c
    	5f20: 00000002 c010694c c010690c d5bd5f88 00000002 c8fc6840 c8fc684c c0105e08
    	5f40: 00000000 00000000 d20d1580 00000002 000af408 d5bd5f88 c000de84 c00b76d4
    	5f60: d20d1580 000af408 00000002 d20d1580 d20d1580 00000002 000af408 c000de84
    	5f80: 00000000 c00b7a44 00000000 00000000 00000002 b6ebea78 00000002 000af408
    	5fa0: 00000004 c000dd00 b6ebea78 00000002 00000001 000af408 00000002 00000000
    	5fc0: b6ebea78 00000002 000af408 00000004 bee96a4c 000a6094 00000000 000b43a8
    	5fe0: 00000000 bee969cc b6e2eb77 b6e6525c 40070010 00000001 00000000 00000000
    	[<c0316de8>] (iio_compute_scan_bytes) from [<c03175a4>] (__iio_update_buffers+0x248/0x438)
    	[<c03175a4>] (__iio_update_buffers) from [<c03177f4>] (iio_buffer_store_enable+0x60/0x7c)
    	[<c03177f4>] (iio_buffer_store_enable) from [<c01faf1c>] (dev_attr_store+0x18/0x24)
    	[<c01faf1c>] (dev_attr_store) from [<c010694c>] (sysfs_kf_write+0x40/0x4c)
    	[<c010694c>] (sysfs_kf_write) from [<c0105e08>] (kernfs_fop_write+0x110/0x154)
    	[<c0105e08>] (kernfs_fop_write) from [<c00b76d4>] (vfs_write+0xbc/0x170)
    	[<c00b76d4>] (vfs_write) from [<c00b7a44>] (SyS_write+0x40/0x78)
    	[<c00b7a44>] (SyS_write) from [<c000dd00>] (ret_fast_syscall+0x0/0x30)
    
    Fixes: 959d2952
    
     ("staging:iio: make iio_sw_buffer_preenable much more general.")
    Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
    e1055473