Brian Norris 715780ae4b firmware: actually return NULL on failed request_firmware_nowait() ... The kerneldoc for request_firmware_nowait() says that it may call the provided cont() callback with @fw == NULL, if the firmware request fails. However, this is not the case when called with an empty string (""). This case is short-circuited by the 'name[0] == '\0'' check introduced in commit 471b095dfe ("firmware_class: make sure fw requests contain a name"), so _request_firmware() never gets to set the fw to NULL. Noticed while using the new 'trigger_async_request' testing hook: # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request [10553.726178] test_firmware: loading '' [10553.729859] test_firmware: loaded: 995209091 # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request [10733.676184] test_firmware: loading '' [10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004 [10733.687951] pgd = ec188000 [10733.690655] [00000004] *pgd=00000000 [10733.694240] Internal error: Oops: 5 [#1] SMP ARM [10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun [10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178 [10733.733137] Hardware name: Rockchip (Device Tree) [10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000 [10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0 [10733.747831] LR is at _raw_spin_lock+0x18/0x1c [10733.752180] pc : [<c00653a0>] lr : [<c054c204>] psr: a00d0013 [10733.752180] sp : ee323df8 ip : ee323e20 fp : ee323e1c [10733.763634] r10: 00000051 r9 : b6f18000 r8 : ee323f80 [10733.768847] r7 : c089cebc r6 : 00000001 r5 : 00000000 r4 : ec0e6000 [10733.775360] r3 : dead4ead r2 : c06bd140 r1 : eef913b4 r0 : 00000000 [10733.781874] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [10733.788995] Control: 10c5387d Table: 2c18806a DAC: 00000051 [10733.794728] Process bash (pid: 6600, stack limit = 0xee322218) [10733.800549] Stack: (0xee323df8 to 0xee324000) [10733.804896] 3de0: ec0e6000 00000000 [10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394 [10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48 [10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac [10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c [10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720 [10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00 [10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8 [10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001 [10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28 [10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80 [10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00 [10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24 [10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8 [10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000 [10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84 [10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390 [10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c) [10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64) [10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74) [10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124) [10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34) [10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58) [10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8) [10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4) After this patch: # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request [ 32.126322] test_firmware: loading '' [ 32.129995] test_firmware: failed to async load firmware -bash: printf: write error: No such device Fixes: 471b095dfe ("firmware_class: make sure fw requests contain a name") Signed-off-by: Brian Norris <computersforpeace@gmail.com> Acked-by: Ming Lei <ming.lei@canonical.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>		2016-01-07 13:45:34 -07:00
..
power	More power management and ACPI updates for v4.4-rc1	2015-11-12 11:50:33 -08:00
regmap	driver core update for 4.4-rc1	2015-11-04 21:50:37 -08:00
attribute_container.c	attribute_container: fix missing blank lines after declarations	2015-03-25 14:35:09 +01:00
base.h	driver core: correct device's shutdown order	2015-08-05 17:07:19 -07:00
bus.c	driver-core: add asynchronous probing support for drivers	2015-05-20 00:25:24 -07:00
cacheinfo.c	cpu/cacheinfo: Fix teardown path	2015-09-17 06:06:54 -07:00
class.c	class_find_device: fix reference to argument "match"	2015-09-29 15:23:14 +02:00
component.c	component: fix bug with legacy API	2014-07-04 18:05:05 +01:00
container.c	ACPI / hotplug / driver core: Handle containers in a special way	2013-12-29 15:25:48 +01:00
core.c	of: to support binding numa node to specified device in devicetree	2015-10-17 22:11:50 -07:00
cpu.c	cpu: Remove bogus __ref annotation of cpu_subsys_online()	2015-08-05 15:18:26 -07:00
dd.c	drivers/pinctrl: Add the concept of an "init" state	2015-10-27 11:24:23 +01:00
devcoredump.c	devcoredump: provide a one-way disable function	2014-11-26 19:40:12 -08:00
devres.c	devm: make allocations numa aware by default	2015-10-09 17:00:33 -04:00
devtmpfs.c	VFS: assorted weird filesystems: d_inode() annotations	2015-04-15 15:06:58 -04:00
dma-coherent.c	drivers: dma-coherent: add initialization from device tree	2014-10-14 02:18:12 +02:00
dma-contiguous.c	driver core update for 4.4-rc1	2015-11-04 21:50:37 -08:00
dma-mapping.c	drivers: base: dma-mapping: Erase blank space after pointer	2015-03-25 14:36:19 +01:00
driver.c	driver core: add missing blank line after declaration	2015-03-25 14:36:30 +01:00
firmware_class.c	firmware: actually return NULL on failed request_firmware_nowait()	2016-01-07 13:45:34 -07:00
firmware.c
hypervisor.c
init.c	drivers: of/base: move of_init to driver_init	2015-05-26 19:55:56 -07:00
isa.c
Kconfig	cma: make default CMA area size zero for x86	2014-12-10 17:41:06 -08:00
Makefile	drivers/base: Add MSI domain support for non-PCI devices	2015-07-30 00:14:38 +02:00
map.c	drivers: base: map: Use kmalloc_array instead of kmalloc	2015-03-25 14:35:08 +01:00
memory.c	mm, hotplug: fix concurrent memory hot-add deadlock	2015-04-14 16:49:00 -07:00
module.c
node.c	Revert "mm: Check if section present during memory block (un)registering"	2015-10-13 10:57:25 -07:00
pinctrl.c	drivers/pinctrl: Add the concept of an "init" state	2015-10-27 11:24:23 +01:00
platform-msi.c	irqdomain/msi: Use fwnode instead of of_node	2015-10-13 19:01:25 +02:00
platform.c	driver-core: platform: Provide helpers for multi-driver modules	2015-10-05 05:02:40 +01:00
property.c	device property: ACPI: Remove unused DMA APIs	2015-11-07 01:29:22 +01:00
soc.c	base: soc: siplify ida usage	2015-10-04 19:42:22 +01:00
syscore.c	genirq: Simplify wakeup mechanism	2014-09-01 13:48:59 +02:00
topology.c	sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()	2015-05-27 15:22:15 +02:00
transport_class.c