[PATCH v2] PCI: imx6: Avoid dereferencing a NULL clock name

[PATCH v2] PCI: imx6: Avoid dereferencing a NULL clock name

[Rudi Heitbaum]

of_clk_bulk_get() leaves clk_bulk_data::id as NULL for every clock that
has no matching entry in "clock-names", which is legal: a node may list
more "clocks" phandles than it names. Both scans of the bulk array
dereference that id unconditionally, so such a node oopses during probe.

The loop in imx_pcie_probe() has been wrong since it was written. The
loop in imx_setup_phy_mpll() was not: it read a fixed clks[] whose ids
came from the driver's own clk_names[] and were never NULL, and only
became wrong when the driver moved to the bulk array.

Check clk_bulk_data::id before dereferencing it in both.

Fixes: f6a1fdfc78e2 ("PCI: imx6: Use devm_clk_bulk_get_all() to fetch clocks")
Fixes: d8574ce57d76 ("PCI: imx6: Add external reference clock input mode support")
Cc: stable@vger.kernel.org
Acked-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Rudi Heitbaum <rudi@heitbaum.com>
---
Changes in v2:
- Also guard the identical unchecked dereference in imx_setup_phy_mpll(),
  reported by Sashiko and requested by Manivannan Sadhasivam.
- Add the Fixes: tag for that site.
- v1: https://lore.kernel.org/all/am8iBwJSEhYhWTqk@6cfee64030a6/

 drivers/pci/controller/dwc/pci-imx6.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 39790e66b98d..f8dd83a88ddf 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -542,7 +542,7 @@ static int imx_setup_phy_mpll(struct imx_pcie *imx_pcie)
 		return 0;
 
 	for (i = 0; i < imx_pcie->num_clks; i++)
-		if (strncmp(clks[i].id, "pcie_phy", 8) == 0)
+		if (clks[i].id && strncmp(clks[i].id, "pcie_phy", 8) == 0)
 			phy_rate = clk_get_rate(clks[i].clk);
 
 	switch (phy_rate) {
@@ -1836,7 +1836,8 @@ static int imx_pcie_probe(struct platform_device *pdev)
 		return dev_err_probe(dev, imx_pcie->num_clks,
 				     "failed to get clocks\n");
 	for (i = 0; i < imx_pcie->num_clks; i++)
-		if (strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
+		if (imx_pcie->clks[i].id &&
+		    strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
 			imx_pcie->enable_ext_refclk = true;
 
 	if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_HAS_PHYDRV)) {
-- 
2.53.0

Re: [PATCH v2] PCI: imx6: Avoid dereferencing a NULL clock name

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of imx_pcie_host_init() is completely ignored in imx_add_pcie_ep().
--

commit 628ea0e01756defcb86187cc3b9ad1e2b8354965
Author: Rudi Heitbaum <rudi@heitbaum.com>

PCI: imx6: Avoid dereferencing a NULL clock name

This commit prevents a NULL pointer dereference when accessing clock IDs by
checking that clk_bulk_data::id is not NULL before using it in strncmp().
This fixes a probe crash caused by unpopulated clock names.

Link: https://lore.kernel.org/all/am8iBwJSEhYhWTqk@6cfee64030a6/

> diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
> index 39790e66b98dc..f8dd83a88ddf7 100644
> --- a/drivers/pci/controller/dwc/pci-imx6.c
> +++ b/drivers/pci/controller/dwc/pci-imx6.c
> @@ -542,7 +542,7 @@ static int imx_setup_phy_mpll(struct imx_pcie *imx_pcie)
>  		return 0;
>  
>  	for (i = 0; i < imx_pcie->num_clks; i++)
> -		if (strncmp(clks[i].id, "pcie_phy", 8) == 0)
> +		if (clks[i].id && strncmp(clks[i].id, "pcie_phy", 8) == 0)
>  			phy_rate = clk_get_rate(clks[i].clk);
>  
>  	switch (phy_rate) {

[ ... ]

> @@ -1836,7 +1836,8 @@ static int imx_pcie_probe(struct platform_device *pdev)
>  		return dev_err_probe(dev, imx_pcie->num_clks,
>  				     "failed to get clocks\n");
>  	for (i = 0; i < imx_pcie->num_clks; i++)
> -		if (strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
> +		if (imx_pcie->clks[i].id &&
> +		    strncmp(imx_pcie->clks[i].id, "extref", 6) == 0)
>  			imx_pcie->enable_ext_refclk = true;
>  
>  	if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_HAS_PHYDRV)) {

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential problem
with error handling in imx_add_pcie_ep() within this file:

drivers/pci/controller/dwc/pci-imx6.c:imx_add_pcie_ep() {
    ...
	imx_pcie_host_init(pp);
	ep = &pci->ep;
    ...
	ret = dw_pcie_ep_init(ep);
	if (ret) {
    ...
}

The return value of imx_pcie_host_init() is completely ignored. If hardware
initialization steps in imx_pcie_host_init() fail (e.g., regulator_enable or
clk_enable returning an error), it returns a negative error code.

Does ignoring this return value allow execution to proceed and initialize the
endpoint on unpowered or unclocked hardware, triggering a system crash upon
register access in dw_pcie_ep_init()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/aqfqE4OLhnN4a1lW@b65e9c1eb12f?part=1