[PATCH] genirq/irqdomain: Check for NULL in irq_domain_alloc_irqs_hierarchy()

From: Alexander A Sverdlin
Date: Fri Mar 06 2020 - 12:47:49 EST


From: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxx>

irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit
but only one of them checks for the pointer which is being dereferenced
inside the called function. Move the check into the function. This allows
for catching the error instead of the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = 1845a981
[00000000] *pgd=0669c003, *pmd=1f83ff003
Internal error: Oops: 80000207 [#1] PREEMPT SMP THUMB2
Modules linked in: ...
CPU: 4 PID: 3665 Comm: modprobe Tainted: G W O 5.4.15-... #1
Hardware name: LSI Axxia AXM55XX
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
pc : [<00000000>] lr : [<c06c23ff>] psr: 200e0013
sp : c68d5c10 ip : 00000000 fp : d5589900
r10: 00000001 r9 : c68d5c34 r8 : 000002f8
r7 : d60dfe48 r6 : d60a8880 r5 : c06c1899 r4 : c0e04cc8
r3 : c68d5c34 r2 : 00000001 r1 : 000002f8 r0 : e0818800
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 70c5387d Table: 077d4b00 DAC: 55555555
Process modprobe (pid: 3665, stack limit = 0xd2112104)
Stack: (0xc68d5c10 to 0xc68d6000)
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc) from [<c0462a89>] (__irq_domain_alloc_irqs+0xe1/0x24c)
[<c0462a89>] (__irq_domain_alloc_irqs) from [<c0462dad>] (irq_create_fwspec_mapping+0x75/0x194)
[<c0462dad>] (irq_create_fwspec_mapping) from [<c06c2251>] (gpiochip_to_irq+0x5d/0x68)
[<c06c2251>] (gpiochip_to_irq) from [<c06c1c9b>] (gpiod_to_irq+0x2b/0x3c)
[<c06c1c9b>] (gpiod_to_irq) from [<bf973073>] (gpio_irqs_init+0x67/0x170 [gpio_irqs])
[<bf973073>] (gpio_irqs_init [gpio_irqs]) from [<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxx>
---
kernel/irq/irqdomain.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index c1f8fa4..7496eb1 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1326,6 +1326,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
unsigned int irq_base,
unsigned int nr_irqs, void *arg)
{
+ if (!domain->ops->alloc) {
+ pr_debug("domain->ops->alloc() is NULL\n");
+ return -ENOSYS;
+ }
+
return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
}

@@ -1363,11 +1368,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
return -EINVAL;
}

- if (!domain->ops->alloc) {
- pr_debug("domain->ops->alloc() is NULL\n");
- return -ENOSYS;
- }
-
if (realloc && irq_base >= 0) {
virq = irq_base;
} else {
--
2.4.6