Linux 4.14.111

[thirdparty/kernel/stable-queue.git] / releases / 4.14.111 / leds-lp55xx-fix-null-deref-on-firmware-load-failure.patch

diff --git a/releases/4.14.111/leds-lp55xx-fix-null-deref-on-firmware-load-failure.patch b/releases/4.14.111/leds-lp55xx-fix-null-deref-on-firmware-load-failure.patch
new file mode 100644 (file)
index 0000000..5e35272
--- /dev/null
+++ b/releases/4.14.111/leds-lp55xx-fix-null-deref-on-firmware-load-failure.patch
@@ -0,0 +1,58 @@
+From 5f13e1609e1623f0fda6b5a68bf0dc72529a89ce Mon Sep 17 00:00:00 2001
+From: Michal Kazior <michal@plume.com>
+Date: Mon, 11 Feb 2019 10:29:27 +0100
+Subject: leds: lp55xx: fix null deref on firmware load failure
+
+[ Upstream commit 5ddb0869bfc1bca6cfc592c74c64a026f936638c ]
+
+I've stumbled upon a kernel crash and the logs
+pointed me towards the lp5562 driver:
+
+> <4>[306013.841294] lp5562 0-0030: Direct firmware load for lp5562 failed with error -2
+> <4>[306013.894990] lp5562 0-0030: Falling back to user helper
+> ...
+> <3>[306073.924886] lp5562 0-0030: firmware request failed
+> <1>[306073.939456] Unable to handle kernel NULL pointer dereference at virtual address 00000000
+> <4>[306074.251011] PC is at _raw_spin_lock+0x1c/0x58
+> <4>[306074.255539] LR is at release_firmware+0x6c/0x138
+> ...
+
+After taking a look I noticed firmware_release()
+could be called with either NULL or a dangling
+pointer.
+
+Fixes: 10c06d178df11 ("leds-lp55xx: support firmware interface")
+Signed-off-by: Michal Kazior <michal@plume.com>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp55xx-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
+index 5377f22ff994..e2655953667c 100644
+--- a/drivers/leds/leds-lp55xx-common.c
++++ b/drivers/leds/leds-lp55xx-common.c
+@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)
+ 
+       if (!fw) {
+               dev_err(dev, "firmware request failed\n");
+-              goto out;
++              return;
+       }
+ 
+       /* handling firmware data is chip dependent */
+@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware *fw, void *context)
+ 
+       mutex_unlock(&chip->lock);
+ 
+-out:
+       /* firmware should be released for other channel use */
+       release_firmware(chip->fw);
++      chip->fw = NULL;
+ }
+ 
+ static int lp55xx_request_firmware(struct lp55xx_chip *chip)
+-- 
+2.19.1
+