lkml.org 
[lkml]   [2021]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] memory: mtk-smi: Fix a null dereference for the ostd
From
Date
On Fri, 2021-10-29 at 19:35 +0200, Krzysztof Kozlowski wrote:
> On 28/10/2021 07:50, Yong Wu wrote:
> > We add the ostd setting for mt8195. It introduces a abort for the
> > previous SoC which doesn't have ostd setting. This is the log:
> >
> > Unable to handle kernel NULL pointer dereference at virtual address
> > 0000000000000080
> > ...
> > pc : mtk_smi_larb_config_port_gen2_general+0x64/0x130
> > lr : mtk_smi_larb_resume+0x54/0x98
> > ...
> > Call trace:
> > mtk_smi_larb_config_port_gen2_general+0x64/0x130
> > pm_generic_runtime_resume+0x2c/0x48
> > __genpd_runtime_resume+0x30/0xa8
> > genpd_runtime_resume+0x94/0x2c8
> > __rpm_callback+0x44/0x150
> > rpm_callback+0x6c/0x78
> > rpm_resume+0x310/0x558
> > __pm_runtime_resume+0x3c/0x88
> >
> > In the code: larbostd = larb->larb_gen->ostd[larb->larbid],
> > if "larb->larb_gen->ostd" is null, the "larbostd" is the offset, it
> > is
> > also a valid value, thus, use the larb->larb_gen->ostd as the
> > condition
> > inside the "for" loop.
>
> You need to write more clearly, what you are fixing here.
>
> >
> > Signed-off-by: Yong Wu <yong.wu@mediatek.com>
> > ---
> > Hi Krzysztof,
> > Could you help review and conside this as a fix for the mt8195
> > patchset?
> > The mt8195 patchset are not in mainline, thus, I don't know its
> > sha-id,
> > and don't add Fixes tag.
> > Thanks
> > ---
> > drivers/memory/mtk-smi.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
> > index b883dcc0bbfa..0262a59a2d6e 100644
> > --- a/drivers/memory/mtk-smi.c
> > +++ b/drivers/memory/mtk-smi.c
> > @@ -257,7 +257,7 @@ static void
> > mtk_smi_larb_config_port_gen2_general(struct device *dev)
> > if (MTK_SMI_CAPS(flags_general, MTK_SMI_FLAG_SW_FLAG))
> > writel_relaxed(SMI_LARB_SW_FLAG_1, larb->base +
> > SMI_LARB_SW_FLAG);
> >
> > - for (i = 0; i < SMI_LARB_PORT_NR_MAX && larbostd &&
> > !!larbostd[i]; i++)
> > + for (i = 0; i < SMI_LARB_PORT_NR_MAX && larb->larb_gen->ostd &&
> > !!larbostd[i]; i++)
> > writel_relaxed(larbostd[i], larb->base +
> > SMI_LARB_OSTDL_PORTx(i));
>
> The code does not look good. You have already a dereference at line
> 244:
>
> const u8 *larbostd = larb->larb_gen->ostd[larb->larbid];

if larb->larb_gen->ostd is null, larbostd is the offset, e.g. 0x80 in
the log above. thus, we can not use "larbostd[i]" in the "for" loop.

sorry for the unreadable. In this case, is the change ok?

or like this:

-const u8 *larbostd = larb->larb_gen->ostd[larb->larbid];
+const u8 *larbostd = larb->larb_gen->ostd ? larb->larb_gen-ostd[larb-
>larbid] : NULL;

or add a explicit "if":
if (larb->larb_gen->ostd)
larbostd = xxx.

Which one do you prefer?

Thanks.

>
> You are not fixing the NULL pointer dereference.
>
> >
> > for_each_set_bit(i, (unsigned long *)larb->mmu, 32) {
> >
>
>
> Best regards,
> Krzysztof
\
 
 \ /
  Last update: 2021-11-01 07:10    [W:0.189 / U:0.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site