Thread (6 messages) 6 messages, 3 authors, 2021-11-01

Re: [PATCH] memory: mtk-smi: Fix a null dereference for the ostd

From: Yong Wu <yong.wu@mediatek.com>
Date: 2021-11-01 06:09:25
Also in: linux-iommu, linux-mediatek, lkml

On Fri, 2021-10-29 at 19:35 +0200, Krzysztof Kozlowski wrote:
On 28/10/2021 07:50, Yong Wu wrote:
quoted
We add the ostd setting for mt8195. It introduces a abort for the
previous SoC which doesn't have ostd setting. This is the log:

Unable to handle kernel NULL pointer dereference at virtual address
0000000000000080
...
pc : mtk_smi_larb_config_port_gen2_general+0x64/0x130
lr : mtk_smi_larb_resume+0x54/0x98
...
Call trace:
 mtk_smi_larb_config_port_gen2_general+0x64/0x130
 pm_generic_runtime_resume+0x2c/0x48
 __genpd_runtime_resume+0x30/0xa8
 genpd_runtime_resume+0x94/0x2c8
 __rpm_callback+0x44/0x150
 rpm_callback+0x6c/0x78
 rpm_resume+0x310/0x558
 __pm_runtime_resume+0x3c/0x88

In the code: larbostd = larb->larb_gen->ostd[larb->larbid],
if "larb->larb_gen->ostd" is null, the "larbostd" is the offset, it
is
also a valid value, thus, use the larb->larb_gen->ostd as the
condition
inside the "for" loop.
You need to write more clearly, what you are fixing here.
quoted
Signed-off-by: Yong Wu <yong.wu@mediatek.com>
---
Hi Krzysztof,
Could you help review and conside this as a fix for the mt8195
patchset?
The mt8195 patchset are not in mainline, thus, I don't know its
sha-id,
and don't add Fixes tag.
Thanks
---
 drivers/memory/mtk-smi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
index b883dcc0bbfa..0262a59a2d6e 100644
--- a/drivers/memory/mtk-smi.c
+++ b/drivers/memory/mtk-smi.c
@@ -257,7 +257,7 @@ static void
mtk_smi_larb_config_port_gen2_general(struct device *dev)
 	if (MTK_SMI_CAPS(flags_general, MTK_SMI_FLAG_SW_FLAG))
 		writel_relaxed(SMI_LARB_SW_FLAG_1, larb->base +
SMI_LARB_SW_FLAG);
 
-	for (i = 0; i < SMI_LARB_PORT_NR_MAX && larbostd &&
!!larbostd[i]; i++)
+	for (i = 0; i < SMI_LARB_PORT_NR_MAX && larb->larb_gen->ostd &&
!!larbostd[i]; i++)
 		writel_relaxed(larbostd[i], larb->base +
SMI_LARB_OSTDL_PORTx(i));
The code does not look good. You have already a dereference at line
244:

	const u8 *larbostd = larb->larb_gen->ostd[larb->larbid];
if larb->larb_gen->ostd is null, larbostd is the offset, e.g. 0x80 in
the log above. thus, we can not use "larbostd[i]" in the "for" loop.

sorry for the unreadable. In this case, is the change ok?

or like this:

-const u8 *larbostd = larb->larb_gen->ostd[larb->larbid];
+const u8 *larbostd = larb->larb_gen->ostd ? larb->larb_gen-ostd[larb-
larbid] : NULL;
or add a explicit "if":
 if (larb->larb_gen->ostd)
   larbostd = xxx.

Which one do you prefer?

Thanks.
You are not fixing the NULL pointer dereference.
quoted
 
 	for_each_set_bit(i, (unsigned long *)larb->mmu, 32) {

Best regards,
Krzysztof
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help