linux-kernel - Re: [PATCH] ARM i.MX: Fix a kernel panic in i2c_imx_clk_notifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 17 Dec 2018 23:02:09 +0000
From:   Peter Rosin <peda@...ntia.se>
To:     Krzysztof Hałasa <khalasa@...p.pl>,
        Fabio Estevam <festevam@...il.com>
CC:     linux-kernel <linux-kernel@...r.kernel.org>,
        "moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE" 
        <linux-arm-kernel@...ts.infradead.org>,
        linux-i2c <linux-i2c@...r.kernel.org>,
        Lucas Stach <l.stach@...gutronix.de>
Subject: Re: [PATCH] ARM i.MX: Fix a kernel panic in
 i2c_imx_clk_notifier_call().

On 2018-12-17 10:12, Krzysztof Hałasa wrote:
> 90ad2cbe88c22d0215225ab9594eeead0eb24fde changed the i.MX I2C bus driver

This reference should ideally be in a fixes-tag, below...

> to use a notifier whenever the base clock ("ipg" - 66 MHz peripheral
> clock) rate changes.
> 
> Unfortunately one can't use the container_of() macro this way - the
> first argument has to point to a member of the bigger struct (last
> argument). Merely pointing to the same value isn't enough (the clk
> variable which has its address passed to the macro is the clk in
> notifier_block, not the one in imx_i2c_struct, even though both pointers
> point to the same clk struct).
> 
> This bug causes kernel panic when the IPG clock rate changes (e.g. if
> any clock derived from IPG changes).
> 

...right here.

Fixes: 90ad2cbe88c2 ("i2c: imx: use clk notifier for rate changes")
> Signed-off-by: Krzysztof Halasa <khalasa@...p.pl>
> 
> --- a/drivers/i2c/busses/i2c-imx.c
> +++ b/drivers/i2c/busses/i2c-imx.c
> @@ -510,9 +510,9 @@ static int i2c_imx_clk_notifier_call(struct notifier_block *nb,
>  				     unsigned long action, void *data)
>  {
>  	struct clk_notifier_data *ndata = data;
> -	struct imx_i2c_struct *i2c_imx = container_of(&ndata->clk,
> +	struct imx_i2c_struct *i2c_imx = container_of(nb,
>  						      struct imx_i2c_struct,
> -						      clk);
> +						      clk_change_nb);
>  
>  	if (action & POST_RATE_CHANGE)
>  		i2c_imx_set_clk(i2c_imx, ndata->new_rate);
>