All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>,
	Reid Downing <skibletz@gmail.com>,
	linux-kernel@vger.kernel.org
Subject: [PATCH] memory: fsl_ifc: Do not dereference the unset global pointer in probe
Date: Mon,  9 Nov 2026 08:47:08 -0500	[thread overview]
Message-ID: <20261109134708.263012-1-sashal@kernel.org> (raw)
In-Reply-To: <179370686157.132651.15818367772843670877.b4-ty@b4>

Commit a78ee2e05f7c ("memory: fsl_ifc: Clear fsl_ifc_ctrl_dev on probe failure
and removal") assigns fsl_ifc_ctrl_dev near the end of probe, but probe still
reads the IFC revision and fsl_ifc_ctrl_init() still programs the event
registers before that. Both go through ifc_in32() and ifc_out32(), which take
the register endianness from fsl_ifc_ctrl_dev, so the first probe dereferences
a NULL pointer.

Use local accessors that take the endianness from the controller being probed
for these register accesses.

Fixes: a78ee2e05f7c ("memory: fsl_ifc: Clear fsl_ifc_ctrl_dev on probe failure and removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/fsl_ifc.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index 83991c05a6a5c..abd033bd94c5a 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -63,6 +63,23 @@ int fsl_ifc_find(phys_addr_t addr_base)
 }
 EXPORT_SYMBOL(fsl_ifc_find);
 
+static u32 fsl_ifc_ctrl_in32(struct fsl_ifc_ctrl *ctrl, void __iomem *addr)
+{
+	if (ctrl->little_endian)
+		return ioread32(addr);
+
+	return ioread32be(addr);
+}
+
+static void fsl_ifc_ctrl_out32(struct fsl_ifc_ctrl *ctrl, u32 val,
+			       void __iomem *addr)
+{
+	if (ctrl->little_endian)
+		iowrite32(val, addr);
+	else
+		iowrite32be(val, addr);
+}
+
 static int fsl_ifc_ctrl_init(struct fsl_ifc_ctrl *ctrl)
 {
 	struct fsl_ifc_global __iomem *ifc = ctrl->gregs;
@@ -70,16 +87,18 @@ static int fsl_ifc_ctrl_init(struct fsl_ifc_ctrl *ctrl)
 	/*
 	 * Clear all the common status and event registers
 	 */
-	if (ifc_in32(&ifc->cm_evter_stat) & IFC_CM_EVTER_STAT_CSER)
-		ifc_out32(IFC_CM_EVTER_STAT_CSER, &ifc->cm_evter_stat);
+	if (fsl_ifc_ctrl_in32(ctrl, &ifc->cm_evter_stat) & IFC_CM_EVTER_STAT_CSER)
+		fsl_ifc_ctrl_out32(ctrl, IFC_CM_EVTER_STAT_CSER,
+				   &ifc->cm_evter_stat);
 
 	/* enable all error and events */
-	ifc_out32(IFC_CM_EVTER_EN_CSEREN, &ifc->cm_evter_en);
+	fsl_ifc_ctrl_out32(ctrl, IFC_CM_EVTER_EN_CSEREN, &ifc->cm_evter_en);
 
 	/* enable all error and event interrupts */
-	ifc_out32(IFC_CM_EVTER_INTR_EN_CSERIREN, &ifc->cm_evter_intr_en);
-	ifc_out32(0x0, &ifc->cm_erattr0);
-	ifc_out32(0x0, &ifc->cm_erattr1);
+	fsl_ifc_ctrl_out32(ctrl, IFC_CM_EVTER_INTR_EN_CSERIREN,
+			   &ifc->cm_evter_intr_en);
+	fsl_ifc_ctrl_out32(ctrl, 0x0, &ifc->cm_erattr0);
+	fsl_ifc_ctrl_out32(ctrl, 0x0, &ifc->cm_erattr1);
 
 	return 0;
 }
@@ -231,7 +250,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 		dev_dbg(&dev->dev, "IFC REGISTERS are BIG endian\n");
 	}
 
-	version = ifc_in32(&ctrl->gregs->ifc_rev) & FSL_IFC_VERSION_MASK;
+	version = fsl_ifc_ctrl_in32(ctrl, &ctrl->gregs->ifc_rev) &
+		  FSL_IFC_VERSION_MASK;
 
 	banks = (version == FSL_IFC_VERSION_1_0_0) ? 4 : 8;
 	dev_info(&dev->dev, "IFC version %d.%d, %d banks\n",
-- 
2.53.0


  reply	other threads:[~2026-11-09 13:47 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-01 12:08 [PATCH] memory: fsl_ifc: Clear fsl_ifc_ctrl_dev on probe failure and removal Krzysztof Kozlowski
2026-11-03 11:54 ` Krzysztof Kozlowski
2026-11-09 13:47   ` Sasha Levin [this message]
2026-11-11 15:24     ` [PATCH] memory: fsl_ifc: Do not dereference the unset global pointer in probe Krzysztof Kozlowski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261109134708.263012-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=krzk@kernel.org \
    --cc=krzysztof.kozlowski@oss.qualcomm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=skibletz@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.