linux-kernel - Re: [PATCH] clk: sunxi-ng: Fix H6 RTC clock definition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Jul 2022 19:21:29 -0500
From:   Samuel Holland <samuel@...lland.org>
To:     Jernej Skrabec <jernej.skrabec@...il.com>, wens@...e.org
Cc:     mturquette@...libre.com, sboyd@...nel.org, andre.przywara@....com,
        linux-clk@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-sunxi@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] clk: sunxi-ng: Fix H6 RTC clock definition

On 7/19/22 1:37 PM, Jernej Skrabec wrote:
> While RTC clock was added in H616 ccu_common list, it was not in H6
> list. That caused invalid pointer dereference like this:
> 
> Unable to handle kernel NULL pointer dereference at virtual address 000000000000020c
> Mem abort info:
>   ESR = 0x96000004
>   EC = 0x25: DABT (current EL), IL = 32 bits
>   SET = 0, FnV = 0
>   EA = 0, S1PTW = 0
>   FSC = 0x04: level 0 translation fault
> Data abort info:
>   ISV = 0, ISS = 0x00000004
>   CM = 0, WnR = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=000000004d574000
> [000000000000020c] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 96000004 [#1] PREEMPT SMP
> CPU: 3 PID: 339 Comm: cat Tainted: G    B             5.18.0-rc1+ #1352
> Hardware name: Tanix TX6 (DT)
> pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : ccu_gate_is_enabled+0x48/0x74
> lr : ccu_gate_is_enabled+0x40/0x74
> sp : ffff80000c0b76d0
> x29: ffff80000c0b76d0 x28: 00000000016e3600 x27: 0000000000000000
> x26: 0000000000000000 x25: 0000000000000002 x24: ffff00000952fe08
> x23: ffff800009611400 x22: ffff00000952fe79 x21: 0000000000000000
> x20: 0000000000000001 x19: ffff80000aad6f08 x18: 0000000000000000
> x17: 2d2d2d2d2d2d2d2d x16: 2d2d2d2d2d2d2d2d x15: 2d2d2d2d2d2d2d2d
> x14: 0000000000000000 x13: 00000000f2f2f2f2 x12: ffff700001816e89
> x11: 1ffff00001816e88 x10: ffff700001816e88 x9 : dfff800000000000
> x8 : ffff80000c0b7447 x7 : 0000000000000001 x6 : ffff700001816e88
> x5 : ffff80000c0b7440 x4 : 0000000000000001 x3 : ffff800008935c50
> x2 : dfff800000000000 x1 : 0000000000000000 x0 : 000000000000020c
> Call trace:
>  ccu_gate_is_enabled+0x48/0x74
>  clk_core_is_enabled+0x7c/0x1c0
>  clk_summary_show_subtree+0x1dc/0x334
>  clk_summary_show_subtree+0x250/0x334
>  clk_summary_show_subtree+0x250/0x334
>  clk_summary_show_subtree+0x250/0x334
>  clk_summary_show_subtree+0x250/0x334
>  clk_summary_show+0x90/0xdc
>  seq_read_iter+0x248/0x6d4
>  seq_read+0x17c/0x1fc
>  full_proxy_read+0x90/0xf0
>  vfs_read+0xdc/0x28c
>  ksys_read+0xc8/0x174
>  __arm64_sys_read+0x44/0x5c
>  invoke_syscall+0x60/0x190
>  el0_svc_common.constprop.0+0x7c/0x160
>  do_el0_svc+0x38/0xa0
>  el0_svc+0x68/0x160
>  el0t_64_sync_handler+0x10c/0x140
>  el0t_64_sync+0x18c/0x190
> Code: d1006260 97e5c981 785e8260 8b0002a0 (b9400000)
> ---[ end trace 0000000000000000 ]---
> 
> Fix that by adding rtc clock to H6 ccu_common list too.
> 
> Fixes: 38d321b61bda ("clk: sunxi-ng: h6-r: Add RTC gate clock")
> Signed-off-by: Jernej Skrabec <jernej.skrabec@...il.com>

Reviewed-by: Samuel Holland <samuel@...lland.org>

This bug also got fixed in passing by e1c51d31befc ("clk: sunxi-ng: Deduplicate
ccu_clks arrays"), but that won't land until 5.20.

Regards,
Samuel

> ---
>  drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
> index 29a8c710ae06..b7962e5149a5 100644
> --- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
> +++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
> @@ -138,6 +138,7 @@ static struct ccu_common *sun50i_h6_r_ccu_clks[] = {
>  	&r_apb2_rsb_clk.common,
>  	&r_apb1_ir_clk.common,
>  	&r_apb1_w1_clk.common,
> +	&r_apb1_rtc_clk.common,
>  	&ir_clk.common,
>  	&w1_clk.common,
>  };
>