linux-kernel - Re: [PATCH v6 1/9] soc: qcom: cpr3: Fix 'acc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zo5sJ1Uk7wAzWflg@hu-varada-blr.qualcomm.com>
Date: Wed, 10 Jul 2024 16:40:31 +0530
From: Varadarajan Narayanan <quic_varada@...cinc.com>
To: Konrad Dybcio <konrad.dybcio@...aro.org>
CC: <robh@...nel.org>, <krzk+dt@...nel.org>, <conor+dt@...nel.org>,
        <andersson@...nel.org>, <mturquette@...libre.com>, <sboyd@...nel.org>,
        <ilia.lin@...nel.org>, <rafael@...nel.org>, <viresh.kumar@...aro.org>,
        <ulf.hansson@...aro.org>, <quic_sibis@...cinc.com>,
        <quic_rjendra@...cinc.com>, <danila@...xyga.com>,
        <neil.armstrong@...aro.org>, <otto.pflueger@...cue.de>,
        <abel.vesa@...aro.org>, <luca@...tu.xyz>, <geert+renesas@...der.be>,
        <stephan.gerhold@...nkonzept.com>, <linux-arm-msm@...r.kernel.org>,
        <devicetree@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-pm@...r.kernel.org>, <linux-clk@...r.kernel.org>
Subject: Re: [PATCH v6 1/9] soc: qcom: cpr3: Fix 'acc_desc' usage

On Wed, Jul 10, 2024 at 01:05:12PM +0200, Konrad Dybcio wrote:
> On 10.07.2024 8:10 AM, Varadarajan Narayanan wrote:
> > cpr3 code assumes that 'acc_desc' is available for SoCs
> > implementing CPR version 4 or less. However, IPQ9574 SoC
> > implements CPRv4 without ACC. This causes NULL pointer accesses
> > resulting in crashes. Hence, check if 'acc_desc' is populated
> > before using it.
> >
> > Signed-off-by: Varadarajan Narayanan <quic_varada@...cinc.com>
> > ---
>
> Does it not work if you drop this patch?
>
> In v15, drv->tcsr is left NULL (from kzalloc), unless data->acc_desc
> is present

It crashed for me with NULL pointer access.

	Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
	input: gpio-keys as /devices/platform/gpio-keys/input/input0
	Mem abort info:
	  ESR = 0x0000000096000004
	  EC = 0x25: DABT (current EL), IL = 32 bits
	  SET = 0, FnV = 0
	  EA = 0, S1PTW = 0
	clk: Disabling unused clocks
	  FSC = 0x04: level 0 translation fault
	Data abort info:
	  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
	  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
	PM: genpd: Disabling unused power domains
	  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
	[0000000000000010] user address but active_mm is swapper
	Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
	Modules linked in:
	CPU: 0 UID: 0 PID: 74 Comm: sugov:0 Not tainted 6.10.0-rc6-next-20240703-00018-g3dfa5a2e6f31-dirty #13
	Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
	pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
	pc : cpr_commit_state+0x228/0x2a8
	lr : cpr_commit_state+0x10c/0x2a8
	sp : ffff800086163a90
	x29: ffff800086163a90 x28: 0000000000000000 x27: 0000000000000000
	x26: 0000000000000000 x25: ffff000006953080 x24: ffff000006913280
	x23: 00000000000fa3e8 x22: 00000000000fa3e8 x21: 00000000000fa3e8
	x20: 0000000000000003 x19: 00000000000fa3e8 x18: 0000000000000000
	x17: 63682d6963687820 x16: 0000000000000000 x15: ffff00003fc8fd00
	x14: 0000000000000000 x13: 0000000000000001 x12: ffff8000814e8c60
	x11: 0000000000000000 x10: 00000000000009b0 x9 : 0000000000000000
	x8 : ffff00003fc87f40 x7 : 0000000000000240 x6 : 0000000000000002
	x5 : 000000000000007f x4 : 0000000000000000 x3 : 0000000000000000
	x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
	Call trace:
	 cpr_commit_state+0x228/0x2a8
	 cpr_set_performance_state+0x94/0xf4
	 _genpd_set_performance_state+0x190/0x1ac
	 genpd_set_performance_state.isra.0+0xbc/0xdc
	 genpd_dev_pm_set_performance_state+0x60/0xc0
	 dev_pm_domain_set_performance_state+0x24/0x3c
	 _set_opp+0xb4/0x51c
	 dev_pm_opp_set_opp+0x70/0xfc
	 _set_required_opps.isra.0+0x74/0xd4
	 _set_opp+0x90/0x51c
	 dev_pm_opp_set_rate+0x184/0x274
	 set_target+0x34/0x40
	 __cpufreq_driver_target+0x250/0x698
	 sugov_work+0x54/0x70
	 kthread_worker_fn+0xc4/0x174
	 kthread+0x110/0x114
	 ret_from_fork+0x10/0x20

Thanks
Varada