linux-kernel - [PATCH v2] pmdomain: rockchip: fix rockchip_pd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20241214215802.23989-1-pgwipeout@gmail.com>
Date: Sat, 14 Dec 2024 21:58:02 +0000
From: Peter Geis <pgwipeout@...il.com>
To: Heiko Stuebner <heiko@...ech.de>
Cc: Ulf Hansson <ulf.hansson@...aro.org>,
	Sebastian Reichel <sebastian.reichel@...labora.com>,
	Dragan Simic <dsimic@...jaro.org>,
	Peter Geis <pgwipeout@...il.com>,
	Detlev Casanova <detlev.casanova@...labora.com>,
	Finley Xiao <finley.xiao@...k-chips.com>,
	Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>,
	linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org,
	linux-pm@...r.kernel.org,
	linux-rockchip@...ts.infradead.org
Subject: [PATCH v2] pmdomain: rockchip: fix rockchip_pd_power error handling

The calls rockchip_pd_power makes to rockchip_pmu_set_idle_request lack
any return error handling, causing device drivers to incorrectly believe
the hardware idle requests succeed when they may have failed. This leads
to software possibly accessing hardware that is powered off and the
subsequent SError panic that follows.

Add error checking and return errors to the calling function to prevent
such crashes.

gst-launch-1.0 videotestsrc num-buffers=2000 ! v4l2jpegenc ! fakesink
Setting pipeline to PAUSED ...er-x64
Pipeline is PREROLLING ...
Redistribute latency...
rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x98260
SError Interrupt on CPU2, code 0x00000000bf000002 -- SError

Signed-off-by: Peter Geis <pgwipeout@...il.com>

---
I have pulled this patch out to be standalone and rebased it on
Sebastian's pmdomain work. It is now dependent on their series [1].

[1] https://lore.kernel.org/linux-rockchip/20241211143044.9550-1-sebastian.reichel@collabora.com/T/#t

Changes in v2:
- Rebase on Sebastian's pmdomain work.
- Handle clock cleanup.
- Clean up commit message.
- Pull this patch from the series and submit alone.

 drivers/pmdomain/rockchip/pm-domains.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/pmdomain/rockchip/pm-domains.c b/drivers/pmdomain/rockchip/pm-domains.c
index 31c71b6fddf1..9f6640063fda 100644
--- a/drivers/pmdomain/rockchip/pm-domains.c
+++ b/drivers/pmdomain/rockchip/pm-domains.c
@@ -602,26 +602,29 @@ static int rockchip_pd_power(struct rockchip_pm_domain *pd, bool power_on)
 		rockchip_pmu_save_qos(pd);
 
 		/* if powering down, idle request to NIU first */
-		rockchip_pmu_set_idle_request(pd, true);
+		ret = rockchip_pmu_set_idle_request(pd, true);
+		if (ret < 0)
+			goto out;
 	}
 
 	ret = rockchip_do_pmu_set_power_domain(pd, power_on);
-	if (ret < 0) {
-		clk_bulk_disable(pd->num_clks, pd->clks);
-		return ret;
-	}
+	if (ret < 0)
+		goto out;
 
 	if (power_on) {
 		/* if powering up, leave idle mode */
-		rockchip_pmu_set_idle_request(pd, false);
+		ret = rockchip_pmu_set_idle_request(pd, false);
+		if (ret < 0)
+			goto out;
 
 		rockchip_pmu_restore_qos(pd);
 	}
 
+out:
 	rockchip_pmu_ungate_clk(pd, false);
 	clk_bulk_disable(pd->num_clks, pd->clks);
 
-	return 0;
+	return ret;
 }
 
 static int rockchip_pd_regulator_disable(struct rockchip_pm_domain *pd)
-- 
2.39.5