From patchwork Wed Apr 19 09:54:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sudeep Holla X-Patchwork-Id: 13216581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DEAD7C77B7E for ; Wed, 19 Apr 2023 09:55:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References:Message-Id :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=OOaUBnfM8NYkVjzxYJYSoqWh7fNQSmIdEv57A4KPm4g=; b=FAacAOoMkovlZk P05SNaRiuqRs94l+jhUHN+BY2LxNzOZcpUbOGVN7KqPrijGgOoXaGV9Db6KFQTIwYEs/h5nHpO83c Fjq6TzKQ16Qw0Njrv28wKwpaRXG1k8VhgQZ8gA80qQoOiYIVQTW44s6/8xt1mv0u8xcM7o+5emuTF o8EoMTGSgKbxnHjuMaxO8au0wWZXmrxWNUt+z4DgHa+8qXZgT33oWoUuVdERbbn0wSdRfexElllWF KRwdLJmvZWS/W9E/tSKoQ6qZ4ep2kseCOSw7dgGhASmx5/dte5xra4OpjTq1/fh9SrTOA0YMybH9x j38wZJrNGeV1vGpYU3cg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1pp4WZ-004opw-2E; Wed, 19 Apr 2023 09:54:51 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1pp4WP-004olG-0v for linux-arm-kernel@lists.infradead.org; Wed, 19 Apr 2023 09:54:44 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2B046106F; Wed, 19 Apr 2023 02:55:22 -0700 (PDT) Received: from e103737-lin.cambridge.arm.com (e103737-lin.cambridge.arm.com [10.1.197.49]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id B70483F6C4; Wed, 19 Apr 2023 02:54:37 -0700 (PDT) From: Sudeep Holla Date: Wed, 19 Apr 2023 10:54:15 +0100 Subject: [PATCH 1/3] firmware: arm_ffa: Check if ffa_driver remove is present before executing MIME-Version: 1.0 Message-Id: <20230419-ffa_fixes_6-4-v1-1-1881ee6699f1@arm.com> References: <20230419-ffa_fixes_6-4-v1-0-1881ee6699f1@arm.com> In-Reply-To: <20230419-ffa_fixes_6-4-v1-0-1881ee6699f1@arm.com> To: linux-arm-kernel@lists.infradead.org Cc: Sudeep Holla , Lucian Paul-Trifu , Marc Bonnici , Jens Wiklander X-Mailer: b4 0.12.1 X-Developer-Signature: v=1; a=openpgp-sha256; l=2280; i=sudeep.holla@arm.com; h=from:subject:message-id; bh=qYbYM/pIaMZFKMylpLoSG/+dQuTtfE41funwQ886cMU=; b=owEBbQKS/ZANAwAIAQBBurwxfuKYAcsmYgBkP7pcQ9EMZQLiCPkINedKxNVYr/ccBgg+BipN6 dGfZJUGPSyJAjMEAAEIAB0WIQS6ceUSBvMeskPdk+EAQbq8MX7imAUCZD+6XAAKCRAAQbq8MX7i mOyPD/9BCrAD+C7N2Bef24CehHvyfzonqzSaOAKtBH3FotQ//kWWhANMSupzS+wpjrb1VN1UE86 mvUWohB1UGR+e73MF+L1U4NILhB78eBCghArsjc9Sdw+jKOc10xhPVBDI/VoGmWrtbux1zr4EWw YgXHzCz/Hma6cnv8ZoAMjzNEchtEshOhF4a/4IjC/1UmifGJgzODtBxmxaFCnCLaYz+0sQatcxc oyUuhEV04Fl/qctxjOOmikI83PfCpIhSlfDnpi+nS5r4okHUUU3rxK2etmfxeEpA4g2lwtkUJ42 UiKtjXFVMwWhuIR44PtQPDp51QHVnqcuqs83FBCSLaoCLgVh/Ma/IIjITLZQGrgsw9EpJSaF/dN Yl8Y7ibkLORfTsQz6NWBEORwD4Ne11f10IF5mLvpwobcu1lJhig6plJuT09dxjtbxkes77fywVN BAFPJWUvP7uR/DxcFVUAkGyqWcHxfYLkc337put2pnihWxnM7nYM3ESbkbi+1CIfPpDgEGEXN2z yoAqjoeDBjaxDnKVH3GFdgK/FAvMHedvB+Zbszq99TPPYrtozQiasqLu2mPrcv2HnCT1X74X9Md pbyFDaxeGc5gnQfDLjQXmELAaMtSZmMZ6ceyiu88G1wqjy/tYwevcioJUnewDtzvKrzd/O7YJ/Z C4SIaQvwo+LNoMA== X-Developer-Key: i=sudeep.holla@arm.com; a=openpgp; fpr=7360A21742ADF5A11767C1C139CFD4755FE2D5B4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230419_025441_427778_D97CC982 X-CRM114-Status: GOOD ( 11.85 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Currently ffa_drv->remove() is called unconditionally from ffa_device_remove(). Since the driver registration doesn't check for it and allows it to be registered without .remove callback, we need to check for the presence of it before executing it from ffa_device_remove() to above a NULL pointer dereference like the one below: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000086000004 | EC = 0x21: IABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6 | Hardware name: FVP Base RevC (DT) | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c) | pc : 0x0 | lr : ffa_device_remove+0x20/0x2c | Call trace: | 0x0 | device_release_driver_internal+0x16c/0x260 | driver_detach+0x90/0xd0 | bus_remove_driver+0xdc/0x11c | driver_unregister+0x30/0x54 | ffa_driver_unregister+0x14/0x20 | cleanup_module+0x18/0xeec | __arm64_sys_delete_module+0x234/0x378 | invoke_syscall+0x40/0x108 | el0_svc_common+0xb4/0xf0 | do_el0_svc+0x30/0xa4 | el0_svc+0x2c/0x7c | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x190/0x194 Fixes: 244f5d597e1e ("firmware: arm_ffa: Add missing remove callback to ffa_bus_type") Signed-off-by: Sudeep Holla --- drivers/firmware/arm_ffa/bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_ffa/bus.c b/drivers/firmware/arm_ffa/bus.c index f29d77ecf72d..36bd5423c2f0 100644 --- a/drivers/firmware/arm_ffa/bus.c +++ b/drivers/firmware/arm_ffa/bus.c @@ -53,7 +53,8 @@ static void ffa_device_remove(struct device *dev) { struct ffa_driver *ffa_drv = to_ffa_driver(dev->driver); - ffa_drv->remove(to_ffa_dev(dev)); + if (ffa_drv->remove) + ffa_drv->remove(to_ffa_dev(dev)); } static int ffa_device_uevent(const struct device *dev, struct kobj_uevent_env *env)