Messages in this thread | | | From | Stephen Boyd <> | Subject | Re: [PATCH] firmware: qcom: scm: Fix crash in qcom_scm_call_atomic1() | Date | Tue, 10 Apr 2018 18:55:04 -0700 |
| |
Quoting Niklas Cassel (2018-04-09 14:40:15) > qcom_scm_call_atomic1() can crash with a NULL pointer dereference at > qcom_scm_call_atomic1+0x30/0x48. > > disassembly of qcom_scm_call_atomic1(): > ... > <0xc08d73b0 <+12>: ldr r3, [r12] > ... (no instruction explicitly modifies r12) > 0xc08d73cc <+40>: smc 0 > ... (no instruction explicitly modifies r12) > 0xc08d73d4 <+48>: ldr r3, [r12] <- crashing instruction > ... > > Since the first ldr is successful, and since r12 isn't explicitly > modified by any instruction between the first and the second ldr, > it must have been modified by the smc call, which is ok, > since r12 is caller save according to the AAPCS. > > Add r12 to the clobber list so that the compiler knows that the > callee potentially overwrites the value in r12. > Clobber descriptions may not in any way overlap with an input or > output operand. > > Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org> > ---
Reviewed-by: Stephen Boyd <sboyd@kernel.org>
| |