From patchwork Thu Oct 14 09:31:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fei Shao X-Patchwork-Id: 12558161 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23FF5C433EF for ; Thu, 14 Oct 2021 09:36:27 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E6B0760FE8 for ; Thu, 14 Oct 2021 09:36:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org E6B0760FE8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=dlVm4iidBtEd73+pBZGWy0GVOuqV11DbvKCAfOZzpJo=; b=N92j25GVmxd/Fe CQK7ppZJDlrFwu/8uu24c2XdOIr4XLMxnfaN/U0EJHqWzAsXIMhDt6muTMdh++o6eRtqi2I0cp6tU 1tbzrnx3+76nZL6KImZ1yHxf/kqdrulfap6A6hxnEuDHC7sBUd6fqyTEQWHUXBAv3FRfxhGpGlfQs ctYPcLx+CXHVF80VrBn/MQmUT00FKkxP3dVAGMmN58opylcdbn+akV4sC4Yv5mCyTQn0ArmbG2pW9 flau+zbiQvFQHSxiK4AHQyuDCWokSLhf80E0bS7WmxJUQgYhkZ1xvQN/Z9enXx0AdeC8vyQZQPKs8 VVBIAFq+G/vQesoT9KOg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1max7e-002Npx-JC; Thu, 14 Oct 2021 09:33:59 +0000 Received: from mail-pl1-x629.google.com ([2607:f8b0:4864:20::629]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1max6V-002NPm-JQ for linux-arm-kernel@lists.infradead.org; Thu, 14 Oct 2021 09:32:48 +0000 Received: by mail-pl1-x629.google.com with SMTP id s1so1936373plg.12 for ; Thu, 14 Oct 2021 02:32:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3N7LqSgN+UZnAqVmRLbsz9jNSkFsNbdadLpiAPsmvpk=; b=TgDBT/R5HvVKa0u4zhVU3L2rR4sTGVKN8VBSQ/gbIfj4Glo7ia+/8PC5icCb4uRw6+ Z7sUeLMjbqq7MG5x8IldR+YRUKu8Fn37oI4kfPTO3mV6TeLU75zv4YFHGjjQqad8tYW2 QDFWX0brHo4Ec/h4sHsklnd0l/SYdQBaAs0lk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3N7LqSgN+UZnAqVmRLbsz9jNSkFsNbdadLpiAPsmvpk=; b=ab3cgKgth3a7vLMu3B15oCjio5dO9OTKhAtXpwL30zQ9bdVlo7PcCx0ilN0ph6T7wX XLc1fNpYleSJP7qpX9yTSftw0bw4AclhXKNqvfRyKrWHspN1CDJKA6FFPzC4Aorkc15b eWAhlchpvzZDkdDMMJGJyNDQXfwkiXnRJV0zT5ngSvLdjgY12dJpU1S2Y97/VtMh467n iRkyzQ2qHLJsaMy2cWOdSZ49s9qwyDvh1EVWO1uawtzQ/3HETrCPeO+lMKAntYjls1w4 wsKS5JI4qun4yqipdXbDxhRKZJY7d6nTJi9W91Ra+OoSt0ZaWPauHT59ShihaT3R2H0K RVog== X-Gm-Message-State: AOAM531ENjdUm9t5wr+GvTmIFRzd54hkvpALYlkWB9rb06nye8WBjQ3A 9BPrkRbaTw9mahFOr5kIfbiTFA== X-Google-Smtp-Source: ABdhPJzo8cSv6WRzPAAlW8Vhmr32cF+Mld9yZj/Q/Fo9HPwQ4SN8yXMworzFOb19WFWs05zoDSIJpA== X-Received: by 2002:a17:90a:b948:: with SMTP id f8mr680033pjw.129.1634203965729; Thu, 14 Oct 2021 02:32:45 -0700 (PDT) Received: from fshao-glinux.tpe.corp.google.com ([2401:fa00:1:10:64c0:3f2d:5152:a6f1]) by smtp.gmail.com with ESMTPSA id k6sm2120116pfg.18.2021.10.14.02.32.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Oct 2021 02:32:45 -0700 (PDT) From: Fei Shao To: Jassi Brar Cc: Chun-Kuang Hu , Fei Shao , Jassi Brar , Matthias Brugger , "jason-jh.lin" , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org Subject: [PATCH 1/2] mailbox: mtk-cmdq: Validate alias_id on probe Date: Thu, 14 Oct 2021 17:31:10 +0800 Message-Id: <20211014093112.3852491-1-fshao@chromium.org> X-Mailer: git-send-email 2.33.0.882.g93a45727a2-goog MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211014_023247_684485_1054A6B6 X-CRM114-Status: GOOD ( 13.01 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org of_alias_get_id() may return -ENODEV which leads to illegal access to the cmdq->clocks array. Adding a check over alias_id to prevent the unexpected behavior. Fixes: 85dfdbfc13ea ("mailbox: cmdq: add multi-gce clocks support for mt8195") Signed-off-by: Fei Shao Reviewed-by: Tzung-Bi Shih --- drivers/mailbox/mtk-cmdq-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index 64175a893312..f3e52dddd422 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -573,7 +573,7 @@ static int cmdq_probe(struct platform_device *pdev) char clk_id[8]; alias_id = of_alias_get_id(node, clk_name); - if (alias_id < cmdq->gce_num) { + if (alias_id >= 0 && alias_id < cmdq->gce_num) { snprintf(clk_id, sizeof(clk_id), "%s%d", clk_name, alias_id); cmdq->clocks[alias_id].id = clk_id; cmdq->clocks[alias_id].clk = of_clk_get(node, 0); From patchwork Thu Oct 14 09:31:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fei Shao X-Patchwork-Id: 12558163 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79733C433EF for ; Thu, 14 Oct 2021 09:37:19 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 422B560E54 for ; Thu, 14 Oct 2021 09:37:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 422B560E54 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=EZfdu+USI2G7yR5XHMvS8Zcv+P+ZVnayh/VvVqUoe1M=; b=3S7WMWxMOkFPg4 zRH73Bgw5Sv7Q5RwoNrdoflvzqMBqHpTcLRS5JcR7YzfpsbqqHBRtktXZwdat+ZcZqUKU3h/YBrVu aUhqSzwe192ieuDRpjffUw8Y4AYy4jqdTa8FEa4Stm12hAqyJNzTgeSl1GklW32+7kVZXafoxtNem 7fF9TLRTx4VSOfpTjN8o19lN8iCDHs3vopJEQxpCpbOTXhhrlKRdXB8fy6tXhhR16sXwwe3hkoz+V QDxQou25ysFAydvq3Ml1QUhPwzNjT/IQx9tfcm+cOsKIBGgNl12TURZREwEN76o8Xas0P4QXEmxww 8cyP1r4RnEw/3bZkHedQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1max8C-002O7U-UT; Thu, 14 Oct 2021 09:34:33 +0000 Received: from mail-pg1-x534.google.com ([2607:f8b0:4864:20::534]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1max6k-002NTt-49 for linux-arm-kernel@lists.infradead.org; Thu, 14 Oct 2021 09:33:03 +0000 Received: by mail-pg1-x534.google.com with SMTP id 133so4993663pgb.1 for ; Thu, 14 Oct 2021 02:33:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=5fwWMum+XGi3+U2DaIfb9q6LtryQgWT3ekOpQvR6dCM=; b=Ol6rRe7O26a+knJp2yEBarjsvc1AXZULqEyq6SqcwKJucDHNVpL17Mrx+bW69+Ch1e WlTXZDDtPg3zodERZTAE7EPuRvQI1fzCk8aaVNaYbuzvb35wBzDLSH0rue3UfG2GPvnU B/qX2dIFsazwatobJ1SUHJqZCTC6+aaenNs3I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=5fwWMum+XGi3+U2DaIfb9q6LtryQgWT3ekOpQvR6dCM=; b=gFdpXNeKcfYMSiPO9LkZqazFGONwqWRetMsBtONQt4MLkYPBL1lnRnpVAjkSAYeSWZ QScW1zYe/5/ddn3CY54kJd1V/HmDxlbRCOcBj0yjf7XJDRh6kMroV95f6aZ3ZUgAPguI kNSMCV09vHOYQV+K8nb2w2GsU1MXuw3RbWXWwibLGWzJnCDA5UJD4yJUAAYvFg0gTW6v Fdc0oGPWDWkAbBYiPEavKOKWAUPzabq7CJN7+9svWUR4KwiyvL/Q5yFuqlTNnPSzQizh KPvjyQN5U+qAFkScdlrpKz0O+YibFmLBwaUXE/9QN3TPwfGVRQvzYaLGGmljmTdNW2l1 PiGQ== X-Gm-Message-State: AOAM533MPr1HQCDgmOVp64be0edG4m+yRfpTIeOUeI/jYimRi19k4VGj gOj/UbIUeRpbgW/Lfp9irWi72TiXsxgSdg== X-Google-Smtp-Source: ABdhPJwA36WyDNJj0nGpSsGt31gMXDVvFxJphvharItmmO5IICkZJmsfpN/t18YYip6v37GGlIaunw== X-Received: by 2002:a65:62cb:: with SMTP id m11mr3373441pgv.425.1634203980906; Thu, 14 Oct 2021 02:33:00 -0700 (PDT) Received: from fshao-glinux.tpe.corp.google.com ([2401:fa00:1:10:64c0:3f2d:5152:a6f1]) by smtp.gmail.com with ESMTPSA id k6sm2120116pfg.18.2021.10.14.02.32.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Oct 2021 02:33:00 -0700 (PDT) From: Fei Shao To: Jassi Brar Cc: Chun-Kuang Hu , Fei Shao , Jassi Brar , Matthias Brugger , "jason-jh.lin" , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org Subject: [PATCH 2/2] mailbox: mtk-cmdq: Fix local clock ID usage Date: Thu, 14 Oct 2021 17:31:11 +0800 Message-Id: <20211014093112.3852491-2-fshao@chromium.org> X-Mailer: git-send-email 2.33.0.882.g93a45727a2-goog In-Reply-To: <20211014093112.3852491-1-fshao@chromium.org> References: <20211014093112.3852491-1-fshao@chromium.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211014_023302_188210_F01B6443 X-CRM114-Status: GOOD ( 16.73 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org In the probe function, the clock IDs were pointed to local variables which should only be used in the same code block, and any access to them after the probing stage becomes a use-after-free case. Since there are only limited variants of the gce clock names so far, we can just declare them as global constants to fix the issue. Fixes: 85dfdbfc13ea ("mailbox: cmdq: add multi-gce clocks support for mt8195") Signed-off-by: Fei Shao --- drivers/mailbox/mtk-cmdq-mailbox.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index f3e52dddd422..27248b31cd51 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -90,6 +90,9 @@ struct gce_plat { u32 gce_num; }; +const char *clk_name = "gce"; +const char *clk_names[] = { "gce0", "gce1" }; + u8 cmdq_get_shift_pa(struct mbox_chan *chan) { struct cmdq *cmdq = container_of(chan->mbox, struct cmdq, mbox); @@ -532,7 +535,6 @@ static int cmdq_probe(struct platform_device *pdev) struct device_node *phandle = dev->of_node; struct device_node *node; int alias_id = 0; - char clk_name[4] = "gce"; cmdq = devm_kzalloc(dev, sizeof(*cmdq), GFP_KERNEL); if (!cmdq) @@ -570,12 +572,9 @@ static int cmdq_probe(struct platform_device *pdev) if (cmdq->gce_num > 1) { for_each_child_of_node(phandle->parent, node) { - char clk_id[8]; - alias_id = of_alias_get_id(node, clk_name); if (alias_id >= 0 && alias_id < cmdq->gce_num) { - snprintf(clk_id, sizeof(clk_id), "%s%d", clk_name, alias_id); - cmdq->clocks[alias_id].id = clk_id; + cmdq->clocks[alias_id].id = clk_names[alias_id]; cmdq->clocks[alias_id].clk = of_clk_get(node, 0); if (IS_ERR(cmdq->clocks[alias_id].clk)) { dev_err(dev, "failed to get gce clk: %d\n", alias_id);