From mboxrd@z Thu Jan 1 00:00:00 1970 From: olof@lixom.net (Olof Johansson) Date: Mon, 14 May 2018 09:24:55 -0700 Subject: [PATCH] ARM: keystone: fix platform_domain_notifier array overrun In-Reply-To: References: Message-ID: <20180514162455.gahb7ikp3bev4b7d@localhost> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Thu, May 10, 2018 at 10:55:39AM -0700, Santosh Shilimkar wrote: > On 5/10/2018 6:24 AM, Russell King wrote: > > platform_domain_notifier contains a variable sized array, which the > > pm_clk_notify() notifier treats as a NULL terminated array: > > > > for (con_id = clknb->con_ids; *con_id; con_id++) > > pm_clk_add(dev, *con_id); > > > > Omitting the initialiser for con_ids means that the array is zero > > sized, and there is no NULL terminator. This leads to pm_clk_notify() > > overrunning into what ever structure follows, which may not be NULL. > > This leads to an oops: > > > > Unable to handle kernel NULL pointer dereference at virtual address 0000008c > > pgd = c0003000 > > [0000008c] *pgd=80000800004003c, *pmd=00000000c > > Internal error: Oops: 206 [#1] PREEMPT SMP ARM > > Modules linked in:c > > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.16.0+ #9 > > Hardware name: Keystone > > PC is at strlen+0x0/0x34 > > LR is at kstrdup+0x18/0x54 > > pc : [] lr : [] psr: 20000013 > > sp : eec73dc0 ip : eed780c0 fp : 00000001 > > r10: 00000000 r9 : 00000000 r8 : eed71e10 > > r7 : 0000008c r6 : 0000008c r5 : 014000c0 r4 : c03a6ff4 > > r3 : c09445d0 r2 : 00000000 r1 : 014000c0 r0 : 0000008c > > Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user > > Control: 30c5387d Table: 00003000 DAC: fffffffd > > Process swapper/0 (pid: 1, stack limit = 0xeec72210) > > Stack: (0xeec73dc0 to 0xeec74000) > > ... > > [] (strlen) from [] (kstrdup+0x18/0x54) > > [] (kstrdup) from [] (__pm_clk_add+0x58/0x120) > > [] (__pm_clk_add) from [] (pm_clk_notify+0x64/0xa8) > > [] (pm_clk_notify) from [] (notifier_call_chain+0x44/0x84) > > [] (notifier_call_chain) from [] (__blocking_notifier_call_chain+0x48/0x60) > > [] (__blocking_notifier_call_chain) from [] (blocking_notifier_call_chain+0x18/0x20) > > [] (blocking_notifier_call_chain) from [] (device_add+0x36c/0x534) > > [] (device_add) from [] (of_platform_device_create_pdata+0x70/0xa4) > > [] (of_platform_device_create_pdata) from [] (of_platform_bus_create+0xf0/0x1ec) > > [] (of_platform_bus_create) from [] (of_platform_populate+0x5c/0xac) > > [] (of_platform_populate) from [] (of_platform_default_populate_init+0x8c/0xa8) > > [] (of_platform_default_populate_init) from [] (do_one_initcall+0x3c/0x164) > > [] (do_one_initcall) from [] (kernel_init_freeable+0x10c/0x1d0) > > [] (kernel_init_freeable) from [] (kernel_init+0x8/0xf0) > > [] (kernel_init) from [] (ret_from_fork+0x14/0x3c) > > Exception stack(0xeec73fb0 to 0xeec73ff8) > > 3fa0: 00000000 00000000 00000000 00000000 > > 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 > > 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 > > Code: e3520000 1afffff7 e12fff1e c0801730 (e5d02000) > > ---[ end trace cafa8f148e262e80 ]--- > > > > Fix this by adding the necessary initialiser. > > > > Fixes: fc20ffe1213b ("ARM: keystone: add PM domain support for clock management") > > Signed-off-by: Russell King > > --- > Looks good. Thanks Russell !! > Acked-by: Santosh Shilimkar > > Arnd, olof, > Could you please pick this up for the fixes branch ? Applied to fixes. Thanks! -Olof