18ec12c97b
Inject fault while probing of-fpga-region, if kasprintf() fails in
module_add_driver(), the second sysfs_remove_link() in exit path will cause
null-ptr-deref as below because kernfs_name_hash() will call strlen() with
NULL driver_name.
Fix it by releasing resources based on the exit path sequence.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfffffc000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region]
CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : strlen+0x24/0xb0
lr : kernfs_name_hash+0x1c/0xc4
sp : ffffffc081f97380
x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0
x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000
x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840
x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42
x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d
x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000
x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001
x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000
x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000
Call trace:
strlen+0x24/0xb0
kernfs_name_hash+0x1c/0xc4
kernfs_find_ns+0x118/0x2e8
kernfs_remove_by_name_ns+0x80/0x100
sysfs_remove_link+0x74/0xa8
module_add_driver+0x278/0x394
bus_add_driver+0x1f0/0x43c
driver_register+0xf4/0x3c0
__platform_driver_register+0x60/0x88
of_fpga_region_init+0x20/0x1000 [of_fpga_region]
do_one_initcall+0x110/0x788
do_init_module+0x1dc/0x5c8
load_module+0x3c38/0x4cac
init_module_from_file+0xd4/0x128
idempotent_init_module+0x2cc/0x528
__arm64_sys_finit_module+0xac/0x100
invoke_syscall+0x6c/0x258
el0_svc_common.constprop.0+0x160/0x22c
do_el0_svc+0x44/0x5c
el0_svc+0x48/0xb8
el0t_64_sync_handler+0x13c/0x158
el0t_64_sync+0x190/0x194
Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
Fixes: 85d2b0aa17 ("module: don't ignore sysfs_create_link() failures")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20240812080658.2791982-1-ruanjinjie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
122 lines
2.4 KiB
C
122 lines
2.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* module.c - module sysfs fun for drivers
|
|
*/
|
|
#include <linux/device.h>
|
|
#include <linux/module.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/string.h>
|
|
#include <linux/rcupdate.h>
|
|
#include "base.h"
|
|
|
|
static char *make_driver_name(const struct device_driver *drv)
|
|
{
|
|
char *driver_name;
|
|
|
|
driver_name = kasprintf(GFP_KERNEL, "%s:%s", drv->bus->name, drv->name);
|
|
if (!driver_name)
|
|
return NULL;
|
|
|
|
return driver_name;
|
|
}
|
|
|
|
static void module_create_drivers_dir(struct module_kobject *mk)
|
|
{
|
|
static DEFINE_MUTEX(drivers_dir_mutex);
|
|
|
|
mutex_lock(&drivers_dir_mutex);
|
|
if (mk && !mk->drivers_dir)
|
|
mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
|
|
mutex_unlock(&drivers_dir_mutex);
|
|
}
|
|
|
|
int module_add_driver(struct module *mod, const struct device_driver *drv)
|
|
{
|
|
char *driver_name;
|
|
struct module_kobject *mk = NULL;
|
|
int ret;
|
|
|
|
if (!drv)
|
|
return 0;
|
|
|
|
if (mod)
|
|
mk = &mod->mkobj;
|
|
else if (drv->mod_name) {
|
|
struct kobject *mkobj;
|
|
|
|
/* Lookup built-in module entry in /sys/modules */
|
|
mkobj = kset_find_obj(module_kset, drv->mod_name);
|
|
if (mkobj) {
|
|
mk = container_of(mkobj, struct module_kobject, kobj);
|
|
/* remember our module structure */
|
|
drv->p->mkobj = mk;
|
|
/* kset_find_obj took a reference */
|
|
kobject_put(mkobj);
|
|
}
|
|
}
|
|
|
|
if (!mk)
|
|
return 0;
|
|
|
|
ret = sysfs_create_link(&drv->p->kobj, &mk->kobj, "module");
|
|
if (ret)
|
|
return ret;
|
|
|
|
driver_name = make_driver_name(drv);
|
|
if (!driver_name) {
|
|
ret = -ENOMEM;
|
|
goto out_remove_kobj;
|
|
}
|
|
|
|
module_create_drivers_dir(mk);
|
|
if (!mk->drivers_dir) {
|
|
ret = -EINVAL;
|
|
goto out_free_driver_name;
|
|
}
|
|
|
|
ret = sysfs_create_link(mk->drivers_dir, &drv->p->kobj, driver_name);
|
|
if (ret)
|
|
goto out_remove_drivers_dir;
|
|
|
|
kfree(driver_name);
|
|
|
|
return 0;
|
|
|
|
out_remove_drivers_dir:
|
|
sysfs_remove_link(mk->drivers_dir, driver_name);
|
|
|
|
out_free_driver_name:
|
|
kfree(driver_name);
|
|
|
|
out_remove_kobj:
|
|
sysfs_remove_link(&drv->p->kobj, "module");
|
|
return ret;
|
|
}
|
|
|
|
void module_remove_driver(const struct device_driver *drv)
|
|
{
|
|
struct module_kobject *mk = NULL;
|
|
char *driver_name;
|
|
|
|
if (!drv)
|
|
return;
|
|
|
|
/* Synchronize with dev_uevent() */
|
|
synchronize_rcu();
|
|
|
|
sysfs_remove_link(&drv->p->kobj, "module");
|
|
|
|
if (drv->owner)
|
|
mk = &drv->owner->mkobj;
|
|
else if (drv->p->mkobj)
|
|
mk = drv->p->mkobj;
|
|
if (mk && mk->drivers_dir) {
|
|
driver_name = make_driver_name(drv);
|
|
if (driver_name) {
|
|
sysfs_remove_link(mk->drivers_dir, driver_name);
|
|
kfree(driver_name);
|
|
}
|
|
}
|
|
}
|