Skip to content

Commit 946593d

Browse files
zhijianli88takaswie
authored andcommitted
Revert "firewire: Kill unnecessary buf check in device_attribute.show"
This reverts commit 4a2b06c. The previous fix didn't consider callers from other than sysfs. Revert it to fix the NULL dereference kernel: ? sysfs_emit+0xb5/0xc0 kernel: show_immediate+0x13f/0x1d0 [firewire_core] kernel: init_fw_attribute_group+0x81/0x150 [firewire_core] kernel: create_units+0x119/0x160 [firewire_core] kernel: fw_device_init+0x1a9/0x330 [firewire_core] kernel: fw_device_workfn+0x12/0x20 [firewire_core] kernel: process_one_work+0x16f/0x350 kernel: worker_thread+0x306/0x440 kernel: ? __pfx_worker_thread+0x10/0x10 kernel: kthread+0xf2/0x120 kernel: ? __pfx_kthread+0x10/0x10 kernel: ret_from_fork+0x47/0x70 kernel: ? __pfx_kthread+0x10/0x10 kernel: ret_from_fork_asm+0x1b/0x30 kernel: </TASK> kernel: ---[ end trace 0000000000000000 ]--- kernel: ------------[ cut here ]------------ Fixes: 4a2b06c ("firewire: Kill unnecessary buf check in device_attribute.show") Reported-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Li Zhijian <lizhijian@fujitsu.com> Link: https://lore.kernel.org/lkml/625470f3-b196-43f7-9844-fa1cb6da99f8@fujitsu.com/ Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
1 parent 4438a81 commit 946593d

1 file changed

Lines changed: 12 additions & 4 deletions

File tree

drivers/firewire/core-device.c

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ static ssize_t show_immediate(struct device *dev,
322322
if (value < 0)
323323
return -ENOENT;
324324

325-
return sysfs_emit(buf, "0x%06x\n", value);
325+
return buf ? sysfs_emit(buf, "0x%06x\n", value) : 0;
326326
}
327327

328328
#define IMMEDIATE_ATTR(name, key) \
@@ -334,6 +334,8 @@ static ssize_t show_text_leaf(struct device *dev,
334334
struct config_rom_attribute *attr =
335335
container_of(dattr, struct config_rom_attribute, attr);
336336
const u32 *directories[] = {NULL, NULL};
337+
size_t bufsize;
338+
char dummy_buf[2];
337339
int i, ret = -ENOENT;
338340

339341
down_read(&fw_device_rwsem);
@@ -355,9 +357,15 @@ static ssize_t show_text_leaf(struct device *dev,
355357
}
356358
}
357359

360+
if (buf) {
361+
bufsize = PAGE_SIZE - 1;
362+
} else {
363+
buf = dummy_buf;
364+
bufsize = 1;
365+
}
366+
358367
for (i = 0; i < ARRAY_SIZE(directories) && !!directories[i]; ++i) {
359-
int result = fw_csr_string(directories[i], attr->key, buf,
360-
PAGE_SIZE - 1);
368+
int result = fw_csr_string(directories[i], attr->key, buf, bufsize);
361369
// Detected.
362370
if (result >= 0) {
363371
ret = result;
@@ -366,7 +374,7 @@ static ssize_t show_text_leaf(struct device *dev,
366374
// in the root directory follows to the directory entry for vendor ID
367375
// instead of the immediate value for vendor ID.
368376
result = fw_csr_string(directories[i], CSR_DIRECTORY | attr->key, buf,
369-
PAGE_SIZE - 1);
377+
bufsize);
370378
if (result >= 0)
371379
ret = result;
372380
}

0 commit comments

Comments
 (0)