linux-kernel - [PATCH] coresight: replicator: Fix panic for clearing claim tag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250502111108.2726217-1-leo.yan@arm.com>
Date: Fri,  2 May 2025 12:11:08 +0100
From: Leo Yan <leo.yan@....com>
To: Suzuki K Poulose <suzuki.poulose@....com>,
	Mike Leach <mike.leach@...aro.org>,
	James Clark <james.clark@...aro.org>,
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
	Yeoreum Yun <yeoreum.yun@....com>,
	coresight@...ts.linaro.org,
	linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Cc: Leo Yan <leo.yan@....com>
Subject: [PATCH] coresight: replicator: Fix panic for clearing claim tag

On platforms with a static replicator, a kernel panic occurs during boot:

  [    4.999406]  replicator_probe+0x1f8/0x360
  [    5.003455]  replicator_platform_probe+0x64/0xd8
  [    5.008115]  platform_probe+0x70/0xf0
  [    5.011812]  really_probe+0xc4/0x2a8
  [    5.015417]  __driver_probe_device+0x80/0x140
  [    5.019813]  driver_probe_device+0xe4/0x170
  [    5.024032]  __driver_attach+0x9c/0x1b0
  [    5.027900]  bus_for_each_dev+0x7c/0xe8
  [    5.031769]  driver_attach+0x2c/0x40
  [    5.035373]  bus_add_driver+0xec/0x218
  [    5.039154]  driver_register+0x68/0x138
  [    5.043023]  __platform_driver_register+0x2c/0x40
  [    5.047771]  coresight_init_driver+0x4c/0xe0
  [    5.052079]  replicator_init+0x30/0x48
  [    5.055865]  do_one_initcall+0x4c/0x280
  [    5.059736]  kernel_init_freeable+0x1ec/0x3c8
  [    5.064134]  kernel_init+0x28/0x1f0
  [    5.067655]  ret_from_fork+0x10/0x20

A static replicator doesn't have registers, so accessing the claim
register results in a NULL pointer deference.  Fixes the issue by
accessing the claim registers only after the I/O resource has been
successfully mapped.

Fixes: 6f4c6f70575f ("coresight: Clear self hosted claim tag on probe")
Signed-off-by: Leo Yan <leo.yan@....com>
---
 drivers/hwtracing/coresight/coresight-replicator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index f1d2f764e898..06efd2b01a0f 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -262,6 +262,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
 		drvdata->base = base;
 		desc.groups = replicator_groups;
 		desc.access = CSDEV_ACCESS_IOMEM(base);
+		coresight_clear_self_claim_tag(&desc.access);
 	}
 
 	if (fwnode_property_present(dev_fwnode(dev),
@@ -284,7 +285,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
 	desc.pdata = dev->platform_data;
 	desc.dev = dev;
 
-	coresight_clear_self_claim_tag(&desc.access);
 	drvdata->csdev = coresight_register(&desc);
 	if (IS_ERR(drvdata->csdev)) {
 		ret = PTR_ERR(drvdata->csdev);
-- 
2.34.1