[PATCH] spmi: pmic-arb: fix nullptr deref on v1 hardware

[PATCH] spmi: pmic-arb: fix nullptr deref on v1 hardware

[Luca Weiss]

[    1.250120] Unable to handle kernel NULL pointer dereference at virtual address 00000940
[    1.255299] pgd = c0204000
[    1.263503] [00000940] *pgd=00000000
[    1.266009] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[    1.269696] Modules linked in:
[    1.274986] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-08608-g25b3421a06a9 #1
[    1.277863] Hardware name: Generic DT based system
[    1.285404] task: ee8a0000 task.stack: ee89c000
[    1.290277] PC is at pmic_arb_ppid_to_apid_v1+0x14/0xf0
[    1.294698] LR is at qpnpint_irq_domain_dt_translate+0xa8/0x1bc

[    1.717902] [<c0722494>] (pmic_arb_ppid_to_apid_v1) from [<c07217ec>] (qpnpint_irq_domain_dt_translate+0xa8/0x1bc)
[    1.726066] [<c07217ec>] (qpnpint_irq_domain_dt_translate) from [<c036bd04>] (irq_create_fwspec_mapping+0x298/0x2f0)
[    1.736305] [<c036bd04>] (irq_create_fwspec_mapping) from [<c036bda8>] (irq_create_of_mapping+0x4c/0x54)

Fixes: 7f1d4e58dabb ("spmi: pmic-arb: optimize table lookups")

Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Signed-off-by: Roy Spliet <nouveau@spliet.org>
---
 drivers/spmi/spmi-pmic-arb.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index 2afe3597982e..6f9018b2836b 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -1048,15 +1048,15 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
 			err = PTR_ERR(pa->wr_base);
 			goto err_put_ctrl;
 		}
+	}
 
-		pa->ppid_to_apid = devm_kcalloc(&ctrl->dev,
-						PMIC_ARB_MAX_PPID,
-						sizeof(*pa->ppid_to_apid),
-						GFP_KERNEL);
-		if (!pa->ppid_to_apid) {
-			err = -ENOMEM;
-			goto err_put_ctrl;
-		}
+	pa->ppid_to_apid = devm_kcalloc(&ctrl->dev,
+					PMIC_ARB_MAX_PPID,
+					sizeof(*pa->ppid_to_apid),
+					GFP_KERNEL);
+	if (!pa->ppid_to_apid) {
+		err = -ENOMEM;
+		goto err_put_ctrl;
 	}
 
 	dev_info(&ctrl->dev, "PMIC arbiter version %s (0x%x)\n",
-- 
2.13.2

Re: [PATCH] spmi: pmic-arb: fix nullptr deref on v1 hardware

[Stephen Boyd]

On 07/08, Luca Weiss wrote:
> [    1.250120] Unable to handle kernel NULL pointer dereference at virtual address 00000940
> [    1.255299] pgd = c0204000
> [    1.263503] [00000940] *pgd=00000000
> [    1.266009] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
> [    1.269696] Modules linked in:
> [    1.274986] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-08608-g25b3421a06a9 #1
> [    1.277863] Hardware name: Generic DT based system
> [    1.285404] task: ee8a0000 task.stack: ee89c000
> [    1.290277] PC is at pmic_arb_ppid_to_apid_v1+0x14/0xf0
> [    1.294698] LR is at qpnpint_irq_domain_dt_translate+0xa8/0x1bc
> 
> [    1.717902] [<c0722494>] (pmic_arb_ppid_to_apid_v1) from [<c07217ec>] (qpnpint_irq_domain_dt_translate+0xa8/0x1bc)
> [    1.726066] [<c07217ec>] (qpnpint_irq_domain_dt_translate) from [<c036bd04>] (irq_create_fwspec_mapping+0x298/0x2f0)
> [    1.736305] [<c036bd04>] (irq_create_fwspec_mapping) from [<c036bda8>] (irq_create_of_mapping+0x4c/0x54)
> 
> Fixes: 7f1d4e58dabb ("spmi: pmic-arb: optimize table lookups")
> 
> Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
> Signed-off-by: Roy Spliet <nouveau@spliet.org>
> ---

Thanks. I already sent a patch for this one though:

http://lkml.kernel.org/r/20170627021746.22445-1-sboyd@codeaurora.org

-- 
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project