linux-kernel - Re: [PATCH] coresight: replicator: Fix panic for clearing claim tag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6f9346a0-03c5-4b00-85f9-0d54e24d0657@linaro.org>
Date: Tue, 6 May 2025 10:27:37 +0100
From: James Clark <james.clark@...aro.org>
To: Leo Yan <leo.yan@....com>
Cc: Suzuki K Poulose <suzuki.poulose@....com>,
 Mike Leach <mike.leach@...aro.org>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Yeoreum Yun <yeoreum.yun@....com>, coresight@...ts.linaro.org,
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] coresight: replicator: Fix panic for clearing claim tag



On 02/05/2025 12:11 pm, Leo Yan wrote:
> On platforms with a static replicator, a kernel panic occurs during boot:
> 
>    [    4.999406]  replicator_probe+0x1f8/0x360
>    [    5.003455]  replicator_platform_probe+0x64/0xd8
>    [    5.008115]  platform_probe+0x70/0xf0
>    [    5.011812]  really_probe+0xc4/0x2a8
>    [    5.015417]  __driver_probe_device+0x80/0x140
>    [    5.019813]  driver_probe_device+0xe4/0x170
>    [    5.024032]  __driver_attach+0x9c/0x1b0
>    [    5.027900]  bus_for_each_dev+0x7c/0xe8
>    [    5.031769]  driver_attach+0x2c/0x40
>    [    5.035373]  bus_add_driver+0xec/0x218
>    [    5.039154]  driver_register+0x68/0x138
>    [    5.043023]  __platform_driver_register+0x2c/0x40
>    [    5.047771]  coresight_init_driver+0x4c/0xe0
>    [    5.052079]  replicator_init+0x30/0x48
>    [    5.055865]  do_one_initcall+0x4c/0x280
>    [    5.059736]  kernel_init_freeable+0x1ec/0x3c8
>    [    5.064134]  kernel_init+0x28/0x1f0
>    [    5.067655]  ret_from_fork+0x10/0x20
> 
> A static replicator doesn't have registers, so accessing the claim
> register results in a NULL pointer deference.  Fixes the issue by
> accessing the claim registers only after the I/O resource has been
> successfully mapped.
> 
> Fixes: 6f4c6f70575f ("coresight: Clear self hosted claim tag on probe")
> Signed-off-by: Leo Yan <leo.yan@....com>
> ---
>   drivers/hwtracing/coresight/coresight-replicator.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
> index f1d2f764e898..06efd2b01a0f 100644
> --- a/drivers/hwtracing/coresight/coresight-replicator.c
> +++ b/drivers/hwtracing/coresight/coresight-replicator.c
> @@ -262,6 +262,7 @@ static int replicator_probe(struct device *dev, struct resource *res)
>   		drvdata->base = base;
>   		desc.groups = replicator_groups;
>   		desc.access = CSDEV_ACCESS_IOMEM(base);
> +		coresight_clear_self_claim_tag(&desc.access);
>   	}
>   
>   	if (fwnode_property_present(dev_fwnode(dev),
> @@ -284,7 +285,6 @@ static int replicator_probe(struct device *dev, struct resource *res)
>   	desc.pdata = dev->platform_data;
>   	desc.dev = dev;
>   
> -	coresight_clear_self_claim_tag(&desc.access);
>   	drvdata->csdev = coresight_register(&desc);
>   	if (IS_ERR(drvdata->csdev)) {
>   		ret = PTR_ERR(drvdata->csdev);

Oops. The other occurrence of this is the funnel, but I got that one right.

Reviewed-by: James Clark <james.clark@...aro.org>