linux-kernel - [PATCH] remoteproc: k3-r5: Fix driver shutdown

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <bf2bd3df-902f-4cef-91fc-2e6438539a01@siemens.com>
Date: Mon, 19 Aug 2024 18:47:20 +0200
From: Jan Kiszka <jan.kiszka@...mens.com>
To: Bjorn Andersson <andersson@...nel.org>,
 Mathieu Poirier <mathieu.poirier@...aro.org>,
 linux-remoteproc@...r.kernel.org
Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
 Apurva Nandan <a-nandan@...com>, Beleswar Padhi <b-padhi@...com>,
 "stable@...r.kernel.org" <stable@...r.kernel.org>, Nishanth Menon <nm@...com>
Subject: [PATCH] remoteproc: k3-r5: Fix driver shutdown

From: Jan Kiszka <jan.kiszka@...mens.com>

When k3_r5_cluster_rproc_exit is run, core 1 is shutdown and removed
first. When core 0 should then be stopped before its removal, it will
find core1->rproc as NULL already and crashes. Happens on rmmod e.g.

Fixes: 3c8a9066d584 ("remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs")
CC: stable@...r.kernel.org
Signed-off-by: Jan Kiszka <jan.kiszka@...mens.com>
---

There might be one more because I can still make this driver crash 
after an operator error. Were error scenarios tested at all?

 drivers/remoteproc/ti_k3_r5_remoteproc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c
index eb09d2e9b32a..9ebd7a34e638 100644
--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c
+++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c
@@ -646,7 +646,8 @@ static int k3_r5_rproc_stop(struct rproc *rproc)
 		/* do not allow core 0 to stop before core 1 */
 		core1 = list_last_entry(&cluster->cores, struct k3_r5_core,
 					elem);
-		if (core != core1 && core1->rproc->state != RPROC_OFFLINE) {
+		if (core != core1 && core1->rproc &&
+		    core1->rproc->state != RPROC_OFFLINE) {
 			dev_err(dev, "%s: can not stop core 0 before core 1\n",
 				__func__);
 			ret = -EPERM;
-- 
2.43.0