kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/firmware
History
Luo Qiu 9beaff47bc firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 
[ Upstream commit 109aa654f8 ]

Fix a kernel crash with the below call trace when the SCPI firmware
returns OPP count of zero.

dvfs_info.opp_count may be zero on some platforms during the reboot
test, and the kernel will crash after dereferencing the pointer to
kcalloc(info->count, sizeof(*opp), GFP_KERNEL).

  |  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
  |  Mem abort info:
  |    ESR = 0x96000004
  |    Exception class = DABT (current EL), IL = 32 bits
  |    SET = 0, FnV = 0
  |    EA = 0, S1PTW = 0
  |  Data abort info:
  |    ISV = 0, ISS = 0x00000004
  |    CM = 0, WnR = 0
  |  user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
  |  [0000000000000028] pgd=0000000000000000
  |  Internal error: Oops: 96000004 [#1] SMP
  |  scpi-hwmon: probe of PHYT000D:00 failed with error -110
  |  Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
  |  CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
  |  Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
  |  pstate: 60000005 (nZCv daif -PAN -UAO)
  |  pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |  lr : clk_register+0x438/0x720
  |  Call trace:
  |   scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |   devm_clk_hw_register+0x50/0xa0
  |   scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
  |   scpi_clocks_probe+0x528/0x70c [clk_scpi]
  |   platform_drv_probe+0x58/0xa8
  |   really_probe+0x260/0x3d0
  |   driver_probe_device+0x12c/0x148
  |   device_driver_attach+0x74/0x98
  |   __driver_attach+0xb4/0xe8
  |   bus_for_each_dev+0x88/0xe0
  |   driver_attach+0x30/0x40
  |   bus_add_driver+0x178/0x2b0
  |   driver_register+0x64/0x118
  |   __platform_driver_register+0x54/0x60
  |   scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
  |   do_one_initcall+0x54/0x220
  |   do_init_module+0x54/0x1c8
  |   load_module+0x14a4/0x1668
  |   __se_sys_finit_module+0xf8/0x110
  |   __arm64_sys_finit_module+0x24/0x30
  |   el0_svc_common+0x78/0x170
  |   el0_svc_handler+0x38/0x78
  |   el0_svc+0x8/0x340
  |  Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
  |  ---[ end trace 06feb22469d89fa8 ]---
  |  Kernel panic - not syncing: Fatal exception
  |  SMP: stopping secondary CPUs
  |  Kernel Offset: disabled
  |  CPU features: 0x10,a0002008
  |  Memory Limit: none

Fixes: 8cb7cf56c9 ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
Signed-off-by: Luo Qiu <luoqiu@kylinsec.com.cn>
Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-12-05 14:01:34 +01:00
..
arm_ffa firmware: arm_ffa: Avoid string-fortify warning caused by memcpy() 2024-10-15 13:50:10 +01:00
arm_scmi pmdomain core: 2024-11-15 10:20:17 -08:00
broadcom MIPS: BCM47XX: remove MODULE_LICENSE in non-modules 2023-04-13 13:13:51 -07:00
cirrus sound updates for 6.11-rc1 2024-07-19 12:39:34 -07:00
efi tpm: fix signed/unsigned bug when checking event logs 2024-12-05 14:01:27 +01:00
google firmware: google: Unregister driver_info on failure 2024-12-05 14:01:16 +01:00
imx firmware: imx: Add i.MX95 MISC driver 2024-08-28 21:54:21 +01:00
meson firmware: meson_sm: add missing MODULE_DESCRIPTION() macro 2024-06-24 10:08:53 +02:00
microchip firmware: microchip: auto-update: fix poll_complete() to not report spurious timeout errors 2024-10-17 17:13:30 +01:00
psci firmware: psci: Fix return value from psci_system_suspend() 2024-06-20 22:58:40 +02:00
qcom firmware: qcom: scm: Return -EOPNOTSUPP for unsupported SHM bridge enabling 2024-10-22 19:05:18 -05:00
smccc arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-11-07 11:18:52 +00:00
tegra firmware: tegra: bpmp: Use scoped device node handling to simplify error paths 2024-08-27 15:58:38 +02:00
xilinx firmware: xilinx: Move FIRMWARE_VERSION_MASK to xlnx-zynqmp.h 2024-06-03 13:07:56 +02:00
arm_scpi.c firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 2024-12-05 14:01:34 +01:00
arm_sdei.c firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() 2024-10-23 16:19:03 +01:00
dmi-id.c firmware: dmi-id: add a release callback function 2024-04-08 09:34:24 +02:00
dmi-sysfs.c firmware: dmi-sysfs: handle HAS_IOPORT=n 2023-05-31 19:17:29 +01:00
dmi_scan.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
edd.c edd: make kobj_type structure constant 2023-03-09 18:07:33 +01:00
iscsi_ibft.c iscsi_ibft: Fix isa_bus_to_virt not working under ARM 2021-09-02 16:22:00 -04:00
iscsi_ibft_find.c iscsi_ibft: Fix finding the iBFT under Xen Dom 0 2023-06-26 07:47:11 +02:00
Kconfig video: Add helpers for decoding screen_info 2024-02-14 10:09:13 +01:00
Makefile Core: 2024-01-12 13:54:25 -08:00
memmap.c firmware: memmap: use default_groups in kobj_type 2022-01-05 19:17:29 +01:00
mtk-adsp-ipc.c firmware: mtk-adsp-ipc: Convert to platform remove callback returning void 2024-01-04 17:01:14 +01:00
qemu_fw_cfg.c fw_cfg: Constify struct kobj_type 2024-09-25 07:07:44 -04:00
raspberrypi.c firmware: raspberrypi: Improve timeout warning 2024-08-13 13:21:28 -07:00
stratix10-rsu.c firmware: stratix10-rsu: Convert to platform remove callback returning void 2024-01-04 17:01:15 +01:00
stratix10-svc.c firmware: stratix10-svc: Convert to platform remove callback returning void 2024-01-04 17:01:15 +01:00
sysfb.c firmware/sysfb: Disable sysfb for firmware buffers with unknown parent 2024-09-26 08:22:20 +02:00
sysfb_simplefb.c firmware/sysfb: Set firmware-framebuffer parent device 2024-02-14 10:09:17 +01:00
ti_sci.c firmware: ti_sci: Unconditionally register reset handler 2024-04-09 11:05:10 -05:00
ti_sci.h firmware: ti_sci: fix TISCI protocol URL link 2024-06-27 17:44:48 -05:00
trusted_foundations.c firmware: tf: Different way of L2 cache enabling after LP2 suspend 2020-05-06 18:27:26 +02:00
turris-mox-rwtm.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00