diff mbox series

[v6,1/9] soc: qcom: cpr3: Fix 'acc_desc' usage

Message ID 20240710061102.1323550-2-quic_varada@quicinc.com (mailing list archive)
State Handled Elsewhere, archived
Headers show
Series Enable CPR for IPQ9574 | expand

Commit Message

Varadarajan Narayanan July 10, 2024, 6:10 a.m. UTC
cpr3 code assumes that 'acc_desc' is available for SoCs
implementing CPR version 4 or less. However, IPQ9574 SoC
implements CPRv4 without ACC. This causes NULL pointer accesses
resulting in crashes. Hence, check if 'acc_desc' is populated
before using it.

Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
---
v6: Changes done in the previous version of this patch got squashed
    into Konrad's V15
	- https://lore.kernel.org/lkml/20240708-topic-cpr3h-v15-9-5bc8b8936489@linaro.org/

    In v14, cpr_set_acc() was invoked from cpr_pre_voltage() or
    cpr_post_voltage(). Both of those functions invoked cpr_set_acc()
    only if drv->tcsr was not NULL (and that implied acc_desc != NULL).
    In v15, cpr_pre_voltage() & cpr_post_voltage() have been
    removed and cpr_set_acc() is called even though acc_desc
    is NULL resulting in NULL pointer access.
    Hence allow cpr_set_acc() to proceed only if acc_desc is set.

v5: Add acc_desc check in a different way without breaking other SoC

v4: Undo the acc_desc validation in probe function as that could
    affect other SoC.
---
 drivers/pmdomain/qcom/cpr3.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

Comments

Konrad Dybcio July 10, 2024, 11:05 a.m. UTC | #1
On 10.07.2024 8:10 AM, Varadarajan Narayanan wrote:
> cpr3 code assumes that 'acc_desc' is available for SoCs
> implementing CPR version 4 or less. However, IPQ9574 SoC
> implements CPRv4 without ACC. This causes NULL pointer accesses
> resulting in crashes. Hence, check if 'acc_desc' is populated
> before using it.
> 
> Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
> ---

Does it not work if you drop this patch?

In v15, drv->tcsr is left NULL (from kzalloc), unless data->acc_desc
is present

Konrad
Varadarajan Narayanan July 10, 2024, 11:10 a.m. UTC | #2
On Wed, Jul 10, 2024 at 01:05:12PM +0200, Konrad Dybcio wrote:
> On 10.07.2024 8:10 AM, Varadarajan Narayanan wrote:
> > cpr3 code assumes that 'acc_desc' is available for SoCs
> > implementing CPR version 4 or less. However, IPQ9574 SoC
> > implements CPRv4 without ACC. This causes NULL pointer accesses
> > resulting in crashes. Hence, check if 'acc_desc' is populated
> > before using it.
> >
> > Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
> > ---
>
> Does it not work if you drop this patch?
>
> In v15, drv->tcsr is left NULL (from kzalloc), unless data->acc_desc
> is present

It crashed for me with NULL pointer access.

	Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
	input: gpio-keys as /devices/platform/gpio-keys/input/input0
	Mem abort info:
	  ESR = 0x0000000096000004
	  EC = 0x25: DABT (current EL), IL = 32 bits
	  SET = 0, FnV = 0
	  EA = 0, S1PTW = 0
	clk: Disabling unused clocks
	  FSC = 0x04: level 0 translation fault
	Data abort info:
	  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
	  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
	PM: genpd: Disabling unused power domains
	  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
	[0000000000000010] user address but active_mm is swapper
	Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
	Modules linked in:
	CPU: 0 UID: 0 PID: 74 Comm: sugov:0 Not tainted 6.10.0-rc6-next-20240703-00018-g3dfa5a2e6f31-dirty #13
	Hardware name: Qualcomm Technologies, Inc. IPQ9574/AP-AL02-C7 (DT)
	pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
	pc : cpr_commit_state+0x228/0x2a8
	lr : cpr_commit_state+0x10c/0x2a8
	sp : ffff800086163a90
	x29: ffff800086163a90 x28: 0000000000000000 x27: 0000000000000000
	x26: 0000000000000000 x25: ffff000006953080 x24: ffff000006913280
	x23: 00000000000fa3e8 x22: 00000000000fa3e8 x21: 00000000000fa3e8
	x20: 0000000000000003 x19: 00000000000fa3e8 x18: 0000000000000000
	x17: 63682d6963687820 x16: 0000000000000000 x15: ffff00003fc8fd00
	x14: 0000000000000000 x13: 0000000000000001 x12: ffff8000814e8c60
	x11: 0000000000000000 x10: 00000000000009b0 x9 : 0000000000000000
	x8 : ffff00003fc87f40 x7 : 0000000000000240 x6 : 0000000000000002
	x5 : 000000000000007f x4 : 0000000000000000 x3 : 0000000000000000
	x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
	Call trace:
	 cpr_commit_state+0x228/0x2a8
	 cpr_set_performance_state+0x94/0xf4
	 _genpd_set_performance_state+0x190/0x1ac
	 genpd_set_performance_state.isra.0+0xbc/0xdc
	 genpd_dev_pm_set_performance_state+0x60/0xc0
	 dev_pm_domain_set_performance_state+0x24/0x3c
	 _set_opp+0xb4/0x51c
	 dev_pm_opp_set_opp+0x70/0xfc
	 _set_required_opps.isra.0+0x74/0xd4
	 _set_opp+0x90/0x51c
	 dev_pm_opp_set_rate+0x184/0x274
	 set_target+0x34/0x40
	 __cpufreq_driver_target+0x250/0x698
	 sugov_work+0x54/0x70
	 kthread_worker_fn+0xc4/0x174
	 kthread+0x110/0x114
	 ret_from_fork+0x10/0x20

Thanks
Varada
diff mbox series

Patch

diff --git a/drivers/pmdomain/qcom/cpr3.c b/drivers/pmdomain/qcom/cpr3.c
index de24973978b7..d594bc79be1c 100644
--- a/drivers/pmdomain/qcom/cpr3.c
+++ b/drivers/pmdomain/qcom/cpr3.c
@@ -536,12 +536,15 @@  static void cpr_corner_restore(struct cpr_thread *thread,
 static void cpr_set_acc(struct cpr_drv *drv, int f)
 {
 	const struct acc_desc *desc = drv->acc_desc;
-	struct reg_sequence *s = desc->settings;
-	int n = desc->num_regs_per_fuse;
+	struct reg_sequence *s;
+	int n;
 
-	if (!drv->tcsr)
+	if (!desc || !drv->tcsr)
 		return;
 
+	s = desc->settings;
+	n = desc->num_regs_per_fuse;
+
 	if (!s || f == drv->fuse_level_set)
 		return;