kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/firmware
History
Andre Przywara 0d276d9f33 firmware: arm_scmi: Fix double free in SMC transport cleanup path 
[ Upstream commit f1d71576d2 ]

When the generic SCMI code tears down a channel, it calls the chan_free
callback function, defined by each transport. Since multiple protocols
might share the same transport_info member, chan_free() might want to
clean up the same member multiple times within the given SCMI transport
implementation. In this case, it is SMC transport. This will lead to a NULL
pointer dereference at the second time:

    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16
    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
    | arm-scmi firmware:scmi: unable to communicate with SCMI
    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
    | Mem abort info:
    |   ESR = 0x0000000096000004
    |   EC = 0x25: DABT (current EL), IL = 32 bits
    |   SET = 0, FnV = 0
    |   EA = 0, S1PTW = 0
    |   FSC = 0x04: level 0 translation fault
    | Data abort info:
    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000
    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
    | Modules linked in:
    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793
    | Hardware name: FVP Base RevC (DT)
    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    | pc : smc_chan_free+0x3c/0x6c
    | lr : smc_chan_free+0x3c/0x6c
    | Call trace:
    |  smc_chan_free+0x3c/0x6c
    |  idr_for_each+0x68/0xf8
    |  scmi_cleanup_channels.isra.0+0x2c/0x58
    |  scmi_probe+0x434/0x734
    |  platform_probe+0x68/0xd8
    |  really_probe+0x110/0x27c
    |  __driver_probe_device+0x78/0x12c
    |  driver_probe_device+0x3c/0x118
    |  __driver_attach+0x74/0x128
    |  bus_for_each_dev+0x78/0xe0
    |  driver_attach+0x24/0x30
    |  bus_add_driver+0xe4/0x1e8
    |  driver_register+0x60/0x128
    |  __platform_driver_register+0x28/0x34
    |  scmi_driver_init+0x84/0xc0
    |  do_one_initcall+0x78/0x33c
    |  kernel_init_freeable+0x2b8/0x51c
    |  kernel_init+0x24/0x130
    |  ret_from_fork+0x10/0x20
    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)
    | ---[ end trace 0000000000000000 ]---

Simply check for the struct pointer being NULL before trying to access
its members, to avoid this situation.

This was found when a transport doesn't really work (for instance no SMC
service), the probe routines then tries to clean up, and triggers a crash.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Fixes: 1dc6558062 ("firmware: arm_scmi: Add smc/hvc transport")
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Link: https://lore.kernel.org/r/20240126122325.2039669-1-andre.przywara@arm.com
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-03-26 18:20:37 -04:00
..
arm_ffa firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of messaging 2023-11-20 11:52:03 +01:00
arm_scmi firmware: arm_scmi: Fix double free in SMC transport cleanup path 2024-03-26 18:20:37 -04:00
broadcom firmware: tee_bnxt: Use UUID API for exporting the UUID 2022-05-05 18:14:29 -07:00
cirrus firmware: cirrus: cs_dsp: Only log list of algorithms in debug build 2023-10-06 14:56:56 +02:00
efi x86/efistub: Give up if memory attribute protocol returns an error 2024-03-06 14:45:20 +00:00
google firmware: coreboot: framebuffer: Ignore reserved pixel color bits 2023-03-10 09:34:02 +01:00
imx firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() 2023-11-02 09:35:25 +01:00
meson firmware: meson_sm: populate platform devices from sm device tree data 2024-01-25 15:27:24 -08:00
psci cpuidle: drivers: firmware: psci: Dont instrument suspend code 2023-03-10 09:33:47 +01:00
smccc firmware: smccc: Fix use of uninitialised results structure 2023-08-11 12:08:10 +02:00
tegra firmware: tegra: Switch over to memdup_user() 2022-09-15 12:45:42 +02:00
xilinx firmware: xilinx: don't make a sleepable memory allocation from an atomic context 2023-03-22 13:33:56 +01:00
arm_scpi.c firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails 2022-07-04 14:28:42 +01:00
arm_sdei.c arm64: sdei: abort running SDEI handlers during crash 2023-09-13 09:43:03 +02:00
dmi-id.c firmware: dmi: Move product_sku info to the end of the modalias 2021-09-02 17:28:53 +02:00
dmi-sysfs.c firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle 2023-03-10 09:33:34 +01:00
dmi_scan.c firmware: dmi: Fortify entry point length checks 2022-09-23 14:53:14 +02:00
edd.c edd: simplify the check of 'attr->test' in edd_populate_dir() 2022-05-19 18:57:04 +02:00
iscsi_ibft.c iscsi_ibft: Fix isa_bus_to_virt not working under ARM 2021-09-02 16:22:00 -04:00
iscsi_ibft_find.c iscsi_ibft: fix warning in reserve_ibft_region() 2021-08-05 19:47:57 -04:00
Kconfig sound updates for 5.19-rc1 2022-05-25 16:55:16 -07:00
Makefile Follow-up tweaks for the EFI changes in v5.19 2022-06-03 13:39:30 -07:00
memmap.c firmware: memmap: use default_groups in kobj_type 2022-01-05 19:17:29 +01:00
mtk-adsp-ipc.c firmware: mediatek: Use meaningful names for mbox 2022-06-22 13:39:30 +01:00
pcdp.c efi/ia64: Move HCDP and MPS table handling into IA64 arch code 2020-02-23 21:59:42 +01:00
pcdp.h firmware: pcdp: Replace zero-length array with flexible-array 2020-06-15 23:08:32 -05:00
qcom_scm-legacy.c firmware: qcom_scm-legacy: correct kerneldoc 2022-06-25 22:04:31 -05:00
qcom_scm-smc.c firmware: qcom_scm: Reduce locking section for __get_convention() 2021-04-06 21:25:23 -05:00
qcom_scm.c firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit 2023-11-28 17:07:12 +00:00
qcom_scm.h firmware: qcom: scm: remove unused __qcom_scm_init declaration 2022-09-13 15:14:54 -05:00
qemu_fw_cfg.c firmware: qemu_fw_cfg: remove sysfs entries explicitly 2022-01-14 18:50:52 -05:00
raspberrypi.c firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() 2022-12-31 13:32:40 +01:00
scpi_pm_domain.c firmware: arm_scpi: Fix string overflow in SCPI genpd driver 2021-12-13 15:17:37 +01:00
stratix10-rsu.c firmware: stratix10-rsu: extend RSU driver to get DCMF status 2022-07-14 16:55:09 +02:00
stratix10-svc.c firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe 2023-09-06 21:27:02 +01:00
sysfb.c efi: sysfb_efi: Fix DMI quirks not working for simpledrm 2023-03-30 12:49:22 +02:00
sysfb_simplefb.c efi: sysfb_efi: Fix DMI quirks not working for simpledrm 2023-03-30 12:49:22 +02:00
ti_sci.c firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() 2024-01-25 15:27:24 -08:00
ti_sci.h firmware: ti_sci: rm: Add new ops for ring configuration 2020-11-01 19:38:02 -08:00
trusted_foundations.c firmware: tf: Different way of L2 cache enabling after LP2 suspend 2020-05-06 18:27:26 +02:00
turris-mox-rwtm.c mvebu drivers for 5.14 (part 1) 2021-06-23 18:57:40 -07:00