[lkml]   [2020]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.14 172/237] thunderbolt: Prevent crash if non-active NVMem file is read
From: Mika Westerberg <>

commit 03cd45d2e219301880cabc357e3cf478a500080f upstream.

The driver does not populate .reg_read callback for the non-active NVMem
because the file is supposed to be write-only. However, it turns out
NVMem subsystem does not yet support this and expects that the .reg_read
callback is provided. If user reads the binary attribute it triggers
NULL pointer dereference like this one:

BUG: kernel NULL pointer dereference, address: 0000000000000000
Call Trace:

Fix this in the driver by providing .reg_read callback that always
returns an error.

Reported-by: Nicholas Johnson <>
Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade")
Signed-off-by: Mika Westerberg <>
Signed-off-by: Greg Kroah-Hartman <>
Signed-off-by: Greg Kroah-Hartman <>

drivers/thunderbolt/switch.c | 7 +++++++
1 file changed, 7 insertions(+)

--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -240,6 +240,12 @@ static int tb_switch_nvm_read(void *priv
return dma_port_flash_read(sw->dma_port, offset, val, bytes);

+static int tb_switch_nvm_no_read(void *priv, unsigned int offset, void *val,
+ size_t bytes)
+ return -EPERM;
static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
size_t bytes)
@@ -285,6 +291,7 @@ static struct nvmem_device *register_nvm
config.read_only = true;
} else { = "nvm_non_active";
+ config.reg_read = tb_switch_nvm_no_read;
config.reg_write = tb_switch_nvm_write;
config.root_only = true;

 \ /
  Last update: 2020-02-27 15:00    [W:0.576 / U:0.924 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site