[PATCH] pcmcia: i82092: fix a null pointer dereference bug

From: Zheyu Ma
Date: Tue Jun 22 2021 - 03:12:26 EST


During the driver loading process, the 'dev' field was not assigned, but
the 'dev' field was referenced in the subsequent 'i82092aa_set_mem_map'
function.

This log reveals it:

[ 3.928168] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 3.928678] #PF: supervisor read access in kernel mode
[ 3.929054] #PF: error_code(0x0000) - not-present page
[ 3.929428] PGD 0 P4D 0
[ 3.929617] Oops: 0000 [#1] PREEMPT SMP PTI
[ 3.929923] CPU: 3 PID: 4409 Comm: pccardd Not tainted 5.13.0-rc7-next-20210621 #1
[ 3.930468] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[ 3.931277] RIP: 0010:i82092aa_set_mem_map+0x45/0x2c0
[ 3.931649] Code: 28 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 f0 44 8f fd 49 8b 84 24 28 09 00 00 48 8b 53 18 48 8d 75 c0 45 8b 6c 24 f0 <48> 8b 78 10 e8 92 05 2f fe 44 0f b6 33 41 80 fe 04 0f 87 16 02 00
[ 3.932973] RSP: 0000:ffffc9000a6bfdb8 EFLAGS: 00010293
[ 3.933351] RAX: 0000000000000000 RBX: ffffc9000a6bfe30 RCX: 0000000000000000
[ 3.933859] RDX: ffffc9000a6bfe50 RSI: ffffc9000a6bfdc8 RDI: ffffffff88457bb0
[ 3.934370] RBP: ffffc9000a6bfe08 R08: 0000000000000001 R09: 0000000000000001
[ 3.934876] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff88457bb0
[ 3.935385] R13: 0000000000000000 R14: ffffffff839f7b80 R15: ffffffff88457bb0
[ 3.935891] FS: 0000000000000000(0000) GS:ffff88817aa00000(0000) knlGS:0000000000000000
[ 3.936467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.936877] CR2: 0000000000000010 CR3: 0000000006c32000 CR4: 00000000000006e0
[ 3.937391] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.937896] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.938082] Call Trace:
[ 3.938082] ? pcmcia_parse_uevents+0xa0/0xa0
[ 3.938082] i82092aa_init+0xb8/0xf0
[ 3.938082] pccardd+0x64/0x590
[ 3.938082] ? __kthread_parkme+0xba/0xe0
[ 3.938082] ? pcmcia_parse_uevents+0xa0/0xa0
[ 3.938082] kthread+0x19a/0x1e0
[ 3.938082] ? set_kthread_struct+0x60/0x60
[ 3.938082] ret_from_fork+0x1f/0x30
[ 3.938082] Modules linked in:
[ 3.938082] Dumping ftrace buffer:
[ 3.938082] (ftrace buffer empty)
[ 3.938082] CR2: 0000000000000010
[ 3.938082] ---[ end trace f4f9ca1497f3c8b2 ]---
[ 3.938082] RIP: 0010:i82092aa_set_mem_map+0x45/0x2c0
[ 3.938082] Code: 28 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 e8 f0 44 8f fd 49 8b 84 24 28 09 00 00 48 8b 53 18 48 8d 75 c0 45 8b 6c 24 f0 <48> 8b 78 10 e8 92 05 2f fe 44 0f b6 33 41 80 fe 04 0f 87 16 02 00
[ 3.938082] RSP: 0000:ffffc9000a6bfdb8 EFLAGS: 00010293
[ 3.938082] RAX: 0000000000000000 RBX: ffffc9000a6bfe30 RCX: 0000000000000000
[ 3.938082] RDX: ffffc9000a6bfe50 RSI: ffffc9000a6bfdc8 RDI: ffffffff88457bb0
[ 3.938082] RBP: ffffc9000a6bfe08 R08: 0000000000000001 R09: 0000000000000001
[ 3.938082] R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff88457bb0
[ 3.938082] R13: 0000000000000000 R14: ffffffff839f7b80 R15: ffffffff88457bb0
[ 3.938082] FS: 0000000000000000(0000) GS:ffff88817aa00000(0000) knlGS:0000000000000000
3.938082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3.938082] CR2: 0000000000000010 CR3: 0000000006c32000 CR4: 00000000000006e0
[ 3.938082] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3.938082] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3.938082] Kernel panic - not syncing: Fatal exception
[ 3.938082] Dumping ftrace buffer:
[ 3.938082] (ftrace buffer empty)
[ 3.938082] Kernel Offset: disabled
[ 3.938082] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma <zheyuma97@xxxxxxxxx>
---
drivers/pcmcia/i82092.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index 85887d885b5f..192c9049d654 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -112,6 +112,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev,
for (i = 0; i < socket_count; i++) {
sockets[i].card_state = 1; /* 1 = present but empty */
sockets[i].io_base = pci_resource_start(dev, 0);
+ sockets[i].dev = dev;
sockets[i].socket.features |= SS_CAP_PCCARD;
sockets[i].socket.map_size = 0x1000;
sockets[i].socket.irq_mask = 0;
--
2.17.6