From patchwork Thu Oct 14 12:03:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fei Shao X-Patchwork-Id: 12558355 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16DB9C433F5 for ; Thu, 14 Oct 2021 12:06:40 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DCBC660E96 for ; Thu, 14 Oct 2021 12:06:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org DCBC660E96 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=YUsaK/+26j4jENM6ioyhuLAhvpN/RktmuHh41iYm2Gw=; b=uc/7jMn2uzXd4P yXGzrtnF/XevBmlPpoT7L8+e/3SQoRwgW3LnqSWwjGICpCqUxAqvnAh3hfr/rzAvYHVAr1jlzw+Ug tgwn2uImcUTDNes84uRM9peh9IiJFzbHFf3tP8ebk8rMQ73BmPrdF9wDn0EOSC23CVLrZpPgZAb+C 23hoC8oJyu+JQOuvQrZZbWeL+GS4jIcgDka7mSM0hZFRMHVOIN1kD2QVRK8vwzWMLB2a5uMGH+T6v oy8bigY6SUQb03pOm8RvfSYrfvCs/VwRMUZHIk8Wt8FGxtrgvwFSSq9q7xa8Wj8dbYm4MLNYNLKtt cXtrxNzJ9hCOAICR+diA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mazTU-002zsO-9U; Thu, 14 Oct 2021 12:04:40 +0000 Received: from mail-pf1-x42f.google.com ([2607:f8b0:4864:20::42f]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mazTK-002znO-W9 for linux-arm-kernel@lists.infradead.org; Thu, 14 Oct 2021 12:04:32 +0000 Received: by mail-pf1-x42f.google.com with SMTP id f11so1372069pfc.12 for ; Thu, 14 Oct 2021 05:04:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ZS8MhlD7ABmZlkxmQInm9HCla87BICXfSMIw1C1cU54=; b=UiaX0lPC+3OXbtfGld9LG1rzAYWJgODKizS41kyTYqH21c+wg6SrSiMTc4xrMfmYc+ U9U/FMqL5iI5+rILj//TJliaWtB9bJWrem2Avxh2Jvbe1MzHdyiBfJWoYjN2Cxn9dBr7 5DVSmJjCclkRo1Yrve7gf8CMh6YHZwcIjpEWk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ZS8MhlD7ABmZlkxmQInm9HCla87BICXfSMIw1C1cU54=; b=XnKR9YSrzbGcH5z7nqY3wzdDdR5/F66ij+wikuRMlF0CXGzlsOLylxj0DS+uVskiXd ImxiW/xEP8UgL1Gowf6VHHpVky6+m4dMGMiBhrEulA0LotDk+uLoFWAgvDy/VamK/9ak qs5V0SR1V1Sw/XQeq5iUBvKJsQN1KoIel2JYNE8zyIbE1B3WF1lqnN7dyrFAHvw+0x8D 8kPFoce1u86iHlPCCtetD0JQEbb6N/J5ayHCq0bLnhlDgVOG1fUnplScW5XC8k7F1o4+ 6qnDGLAnoBkaCUk0WcMqx8mlmtGbtfhL+jZkl4zj9SryXa/OSqNfkRZkwM/ElyWkv8ab eigQ== X-Gm-Message-State: AOAM533U4YOs+1TbcnmJrNXyAPgLBf293nd1Q/xIGro1OXNL706EI0Gm ms/9/aYl41nM+VHEYpSvrmBOJw== X-Google-Smtp-Source: ABdhPJzdRj4HVkNLgkG/WEqH2RrZtn2ign69xKx2wyK3OiBy2swev3QG5m5927mSi42rQmeqd8Jhug== X-Received: by 2002:aa7:824b:0:b0:44c:22ad:2763 with SMTP id e11-20020aa7824b000000b0044c22ad2763mr4913447pfn.63.1634213068837; Thu, 14 Oct 2021 05:04:28 -0700 (PDT) Received: from fshao-glinux.tpe.corp.google.com ([2401:fa00:1:10:64c0:3f2d:5152:a6f1]) by smtp.gmail.com with ESMTPSA id b11sm2300275pge.57.2021.10.14.05.04.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Oct 2021 05:04:28 -0700 (PDT) From: Fei Shao To: Jassi Brar Cc: Chun-Kuang Hu , Tzung-Bi Shih , Fei Shao , Jassi Brar , Matthias Brugger , "jason-jh.lin" , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 1/2] mailbox: mtk-cmdq: Validate alias_id on probe Date: Thu, 14 Oct 2021 20:03:51 +0800 Message-Id: <20211014120352.1506321-2-fshao@chromium.org> X-Mailer: git-send-email 2.33.0.882.g93a45727a2-goog In-Reply-To: <20211014120352.1506321-1-fshao@chromium.org> References: <20211014120352.1506321-1-fshao@chromium.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211014_050431_093082_5A365F14 X-CRM114-Status: GOOD ( 14.02 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org of_alias_get_id() may return -ENODEV which leads to illegal access to the cmdq->clocks array. Adding a check over alias_id to prevent the unexpected behavior. Fixes: 85dfdbfc13ea ("mailbox: cmdq: add multi-gce clocks support for mt8195") Signed-off-by: Fei Shao Reviewed-by: Tzung-Bi Shih --- Changes in v2: - Add Reviewed-by tag drivers/mailbox/mtk-cmdq-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index 64175a893312..f3e52dddd422 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -573,7 +573,7 @@ static int cmdq_probe(struct platform_device *pdev) char clk_id[8]; alias_id = of_alias_get_id(node, clk_name); - if (alias_id < cmdq->gce_num) { + if (alias_id >= 0 && alias_id < cmdq->gce_num) { snprintf(clk_id, sizeof(clk_id), "%s%d", clk_name, alias_id); cmdq->clocks[alias_id].id = clk_id; cmdq->clocks[alias_id].clk = of_clk_get(node, 0); From patchwork Thu Oct 14 12:03:52 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fei Shao X-Patchwork-Id: 12558357 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47E6BC433F5 for ; Thu, 14 Oct 2021 12:07:05 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 0AA8F61040 for ; Thu, 14 Oct 2021 12:07:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 0AA8F61040 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=7DaqAQdI9oPlJI7WYeDN6Wr0Z0iKdH2VzoTxFoSX30g=; b=gCDVRv7tQE5Psy GO10Amd/wsWueGqzqRmQmEbIexBol0YPy1BuXvPDlRy76YkAEFcSf5HskNAg5yDAjhQYj/kpwRFlt 8CYYvclZvwrKnC6fyH8GqbAUZ5Y7dpM2JQsxvtKadSBFi/WaUZHbR66OwuclrCla16DEXzQD3WWJc s86T4RuBnh4pJ7Ht5aLn/tAZ3sl6gedX1PyYCVYMjaMCD952d2mn8Nz4hgm21cp3YE01X5+KqY206 z9a3VUxNm8y9A7QkHaUYWz3c98JONjfBS6bbiayue6y8uXToW9PGsG56ADzrsKjWsTUoqdv3dp28W hH1X/UKJJJWQRt6JIUgA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mazTk-002zxa-Gr; Thu, 14 Oct 2021 12:04:56 +0000 Received: from mail-pf1-x42d.google.com ([2607:f8b0:4864:20::42d]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mazTN-002zp7-B3 for linux-arm-kernel@lists.infradead.org; Thu, 14 Oct 2021 12:04:35 +0000 Received: by mail-pf1-x42d.google.com with SMTP id 187so5237210pfc.10 for ; Thu, 14 Oct 2021 05:04:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=xjtTKqJNAW9TAfK1opWSOcT+9CXDZRVrcJjqizIFop8=; b=VdsdzRAnoo6T3oe5ardLdZQTZfHNI7s0aObN2E47puJxRGKkUA0aqL/OuTMkAqV8v8 Kbs/GAGctRezd7TcrMxuBUIHbGiVWwTZs2n8LWJLdOGaOjQg69LHDXh5e/WMJkhd4rHc /pB+N/2EBvXkvvsiB8ja2gf9a+ZtlCoe+vSS0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=xjtTKqJNAW9TAfK1opWSOcT+9CXDZRVrcJjqizIFop8=; b=3OgmTiREMmWlpGBVYkCgk/1/5AZieQdKd61UdMpsbM5StbCRF2TKG0LjYvkJM1qbxP U+L8nNG1JqBq8rSemNtd6q3ZvHO4rqxARMUd5m1UcbL8RVL6pSrnRAPYiDo2dyEla1Je FOAbD24uCu79hbRvp/yyt/0PX7e/uRzZoGfX9VZrU9SgfKWA1wGFSlAZlem5+D7C+yZ1 37ZK8dqce+0QMJWYXzSTf4P3/ms+ClhCOztNxZzaYkgEqbNZvuIgK7/qJD351DuiTTWS dFTdOTX8OZuggUQx3WqMkkNok/88Tu3QacIs8/Mf7bshmlSiQPcP10/3RhntDFjMN5r+ TuHg== X-Gm-Message-State: AOAM532OoCaoWL/FDABH4RBy5jGiVyYhCXnHidVqWtpjkv+z5qgOzazE w9JJd1pUK+ZVHHflzu2CPpQakQ== X-Google-Smtp-Source: ABdhPJzfAyd5w8l4m9xU+WIpJBe1EuuS5AIYTA+h6Lpw2RNsav3/vZ5qxcdkGjy6ufyy83SyD0FFQA== X-Received: by 2002:a63:3481:: with SMTP id b123mr3910867pga.230.1634213072117; Thu, 14 Oct 2021 05:04:32 -0700 (PDT) Received: from fshao-glinux.tpe.corp.google.com ([2401:fa00:1:10:64c0:3f2d:5152:a6f1]) by smtp.gmail.com with ESMTPSA id b11sm2300275pge.57.2021.10.14.05.04.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 Oct 2021 05:04:31 -0700 (PDT) From: Fei Shao To: Jassi Brar Cc: Chun-Kuang Hu , Tzung-Bi Shih , Fei Shao , Jassi Brar , Matthias Brugger , "jason-jh.lin" , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org Subject: [PATCH v2 2/2] mailbox: mtk-cmdq: Fix local clock ID usage Date: Thu, 14 Oct 2021 20:03:52 +0800 Message-Id: <20211014120352.1506321-3-fshao@chromium.org> X-Mailer: git-send-email 2.33.0.882.g93a45727a2-goog In-Reply-To: <20211014120352.1506321-1-fshao@chromium.org> References: <20211014120352.1506321-1-fshao@chromium.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211014_050433_405251_835C6D6D X-CRM114-Status: GOOD ( 16.27 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org In the probe function, the clock IDs were pointed to local variables which should only be used in the same code block, and any access to them after the probing stage becomes an use-after-free case. Since there are only limited variants of the gce clock names so far, we can just declare them as static constants to fix the issue. Fixes: 85dfdbfc13ea ("mailbox: cmdq: add multi-gce clocks support for mt8195") Signed-off-by: Fei Shao Reviewed-by: Tzung-Bi Shih --- Changes in v2: - Make clock names static drivers/mailbox/mtk-cmdq-mailbox.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) -- 2.33.0.882.g93a45727a2-goog diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index f3e52dddd422..95ce7275641c 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -532,7 +532,8 @@ static int cmdq_probe(struct platform_device *pdev) struct device_node *phandle = dev->of_node; struct device_node *node; int alias_id = 0; - char clk_name[4] = "gce"; + static const char * const clk_name = "gce"; + static const char * const clk_names[] = { "gce0", "gce1" }; cmdq = devm_kzalloc(dev, sizeof(*cmdq), GFP_KERNEL); if (!cmdq) @@ -570,12 +571,9 @@ static int cmdq_probe(struct platform_device *pdev) if (cmdq->gce_num > 1) { for_each_child_of_node(phandle->parent, node) { - char clk_id[8]; - alias_id = of_alias_get_id(node, clk_name); if (alias_id >= 0 && alias_id < cmdq->gce_num) { - snprintf(clk_id, sizeof(clk_id), "%s%d", clk_name, alias_id); - cmdq->clocks[alias_id].id = clk_id; + cmdq->clocks[alias_id].id = clk_names[alias_id]; cmdq->clocks[alias_id].clk = of_clk_get(node, 0); if (IS_ERR(cmdq->clocks[alias_id].clk)) { dev_err(dev, "failed to get gce clk: %d\n", alias_id);