linux-hardened/drivers/of
Gavin Shan 89c67752ae drivers/of: Validate device node in __unflatten_device_tree()
@mynodes is set to NULL when __unflatten_device_tree() is called
to unflatten device sub-tree in PCI hot add scenario on PowerPC
PowerNV platform. Marking @mynodes detached unconditionally causes
kernel crash as below backtrace shows:

Unable to handle kernel paging request for data at address 0x00000000
Faulting instruction address: 0xc000000000b26f64
cpu 0x0: Vector: 300 (Data Access) at [c000003fcc7cf740]
    pc: c000000000b26f64: __unflatten_device_tree+0xf4/0x190
    lr: c000000000b26f40: __unflatten_device_tree+0xd0/0x190
    sp: c000003fcc7cf9c0
   msr: 900000000280b033
   dar: 0
 dsisr: 40000000
  current = 0xc000003fcc281680
  paca    = 0xc00000000ff00000	 softe: 0	 irq_happened: 0x01
    pid   = 2724, comm = sh
Linux version 4.7.0-gavin-07754-g92a6836 (gwshan@gwshan) (gcc version \
4.9.3 (Buildroot 2016.02-rc2-00093-g5ea3bce) ) #539 SMP Mon Aug 1 \
12:40:29 AEST 2016
enter ? for help
[c000003fcc7cfa50] c000000000b27060 of_fdt_unflatten_tree+0x60/0x90
[c000003fcc7cfaa0] c0000000004c6288 pnv_php_set_slot_power_state+0x118/0x440
[c000003fcc7cfb80] c0000000004c6a10 pnv_php_enable+0xc0/0x170
[c000003fcc7cfbd0] c0000000004c4d80 power_write_file+0xa0/0x190
[c000003fcc7cfc50] c0000000004be93c pci_slot_attr_store+0x3c/0x60
[c000003fcc7cfc70] c0000000002d3fd4 sysfs_kf_write+0x94/0xc0
[c000003fcc7cfcb0] c0000000002d2c30 kernfs_fop_write+0x180/0x260
[c000003fcc7cfd00] c000000000230fe0 __vfs_write+0x40/0x190
[c000003fcc7cfd90] c000000000232278 vfs_write+0xc8/0x240
[c000003fcc7cfde0] c000000000233d90 SyS_write+0x60/0x110
[c000003fcc7cfe30] c000000000009524 system_call+0x38/0x108

This avoids the kernel crash by marking @mynodes detached only when
@mynodes is dereferencing valid device node in __unflatten_device_tree().

Fixes: 1d1bde550e ("of: fdt: mark unflattened tree as detached")
Reported-by: Meng Li <shlimeng@cn.ibm.com>
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Rob Herring <robh@kernel.org>
2016-08-09 12:36:27 -05:00
..
unittest-data of/unittest: replace 'selftest' with 'unittest' 2015-03-25 00:53:29 -05:00
address.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
base.c of: Delete an unnecessary check before the function call "of_node_put" 2016-08-09 12:36:27 -05:00
device.c iommu: of: enforce const-ness of struct iommu_ops 2016-05-09 15:33:29 +02:00
dynamic.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
fdt.c drivers/of: Validate device node in __unflatten_device_tree() 2016-08-09 12:36:27 -05:00
fdt_address.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
irq.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
Kconfig of_mdio: select fixed phy support unconditionally 2016-06-28 05:47:52 -04:00
Makefile MTD updates for v4.7: 2016-05-24 11:00:20 -07:00
of_mdio.c of_mdio: Abstract a general interface for phy connect 2016-07-16 21:32:58 -07:00
of_net.c of_net: factor out repetitive code from of_get_mac_address() 2015-03-29 08:56:17 +01:00
of_numa.c arm64, NUMA: rework numa_add_memblk() 2016-05-30 14:27:07 +02:00
of_pci.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
of_pci_irq.c of_pci_irq: Silence bogus "of_irq_parse_pci() failed ..." messages. 2015-09-17 14:46:11 -05:00
of_private.h of: fix memory leak related to safe_name() 2016-06-24 15:16:10 -05:00
of_reserved_mem.c DeviceTree update for 4.8: 2016-07-30 11:32:01 -07:00
overlay.c of: use pr_fmt prefix for all console printing 2016-07-18 16:57:42 -05:00
pdt.c of: Eliminate of_allnodes list 2014-11-04 13:29:38 +00:00
platform.c ramoops: use DT reserved-memory bindings 2016-08-05 11:21:36 -07:00
resolver.c of: overlay: add resolver error prints 2016-07-18 17:18:36 -05:00
unittest.c of: unittest: use of_platform_default_populate() to populate default bus 2016-06-23 15:00:59 -05:00