From: Conor Dooley <conor.dooley@microchip.com>
To: Michael Turquette <mturquette@baylibre.com>,
Stephen Boyd <sboyd@kernel.org>, Rob Herring <robh+dt@kernel.org>,
Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Conor Dooley <conor.dooley@microchip.com>,
Philipp Zabel <p.zabel@pengutronix.de>,
Daire McNamara <daire.mcnamara@microchip.com>
Cc: Paul Walmsley <paul.walmsley@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>, <linux-clk@vger.kernel.org>,
<devicetree@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<linux-riscv@lists.infradead.org>,
Nathan Chancellor <nathan@kernel.org>
Subject: [PATCH v3 01/13] clk: microchip: mpfs: fix clk_cfg array bounds violation
Date: Fri, 19 Aug 2022 10:53:09 +0100 [thread overview]
Message-ID: <20220819095320.40006-2-conor.dooley@microchip.com> (raw)
In-Reply-To: <20220819095320.40006-1-conor.dooley@microchip.com>
Unnoticed in current code, there is an array bounds violation present
during clock registration. This seems to fail gracefully in v6.0-rc1,
and life carrys on. While converting the driver to use standard clock
structs/ops, kernel panics were seen during boot when built with clang:
[ 0.581754] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b1
[ 0.591520] Oops [#1]
[ 0.594045] Modules linked in:
[ 0.597435] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-00011-g8e1459cf4eca #1
[ 0.606188] Hardware name: Microchip PolarFire-SoC Icicle Kit (DT)
[ 0.613012] epc : __clk_register+0x4a6/0x85c
[ 0.617759] ra : __clk_register+0x49e/0x85c
[ 0.622489] epc : ffffffff803faf7c ra : ffffffff803faf74 sp : ffffffc80400b720
[ 0.630466] gp : ffffffff810e93f8 tp : ffffffe77fe60000 t0 : ffffffe77ffb3800
[ 0.638443] t1 : 000000000000000a t2 : ffffffffffffffff s0 : ffffffc80400b7c0
[ 0.646420] s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
[ 0.654396] a2 : 0000000000000001 a3 : 0000000000000000 a4 : 0000000000000000
[ 0.662373] a5 : ffffffff803a5810 a6 : 0000000200000022 a7 : 0000000000000006
[ 0.670350] s2 : ffffffff81099d48 s3 : ffffffff80d6e28e s4 : 0000000000000028
[ 0.678327] s5 : ffffffff810ed3c8 s6 : ffffffff810ed3d0 s7 : ffffffe77ffbc100
[ 0.686304] s8 : ffffffe77ffb1540 s9 : ffffffe77ffb1540 s10: 0000000000000008
[ 0.694281] s11: 0000000000000000 t3 : 00000000000000c6 t4 : 0000000000000007
[ 0.702258] t5 : ffffffff810c78c0 t6 : ffffffe77ff88cd0
[ 0.708125] status: 0000000200000120 badaddr: 00000000000000b1 cause: 000000000000000d
[ 0.716869] [<ffffffff803fb892>] devm_clk_hw_register+0x62/0xaa
[ 0.723420] [<ffffffff80403412>] mpfs_clk_probe+0x1e0/0x244
It fails on "clk_periph_timer" - which uses a different parent, that it
tries to find using the macro:
\#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].cfg.hw)
If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw
which is well beyond the end of the array. Amazingly, builds with GCC
11.1 see no problem here, booting correctly and hooking the parent up
etc. Builds with clang-15 do not, with the above panic.
Drop the macro for the RTCREF and use the array directly to avoid the
panic, using a newly added define that brings the index into the valid
range.
Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control")
CC: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
---
drivers/clk/microchip/clk-mpfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/microchip/clk-mpfs.c b/drivers/clk/microchip/clk-mpfs.c
index 070c3b896559..9e41f07b3fa6 100644
--- a/drivers/clk/microchip/clk-mpfs.c
+++ b/drivers/clk/microchip/clk-mpfs.c
@@ -27,6 +27,8 @@
#define MSSPLL_POSTDIV_WIDTH 0x07u
#define MSSPLL_FIXED_DIV 4u
+#define RTCREF_OFFSET (CLK_RTCREF - CLK_ENVM)
+
struct mpfs_clock_data {
void __iomem *base;
void __iomem *msspll_base;
@@ -381,7 +383,8 @@ static struct mpfs_periph_hw_clock mpfs_periph_clks[] = {
CLK_PERIPH(CLK_MAC0, "clk_periph_mac0", PARENT_CLK(AHB), 1, 0),
CLK_PERIPH(CLK_MAC1, "clk_periph_mac1", PARENT_CLK(AHB), 2, 0),
CLK_PERIPH(CLK_MMC, "clk_periph_mmc", PARENT_CLK(AHB), 3, 0),
- CLK_PERIPH(CLK_TIMER, "clk_periph_timer", PARENT_CLK(RTCREF), 4, 0),
+ CLK_PERIPH(CLK_TIMER, "clk_periph_timer",
+ &mpfs_cfg_clks[CLK_RTCREF - RTCREF_OFFSET].hw, 4, 0),
CLK_PERIPH(CLK_MMUART0, "clk_periph_mmuart0", PARENT_CLK(AHB), 5, CLK_IS_CRITICAL),
CLK_PERIPH(CLK_MMUART1, "clk_periph_mmuart1", PARENT_CLK(AHB), 6, 0),
CLK_PERIPH(CLK_MMUART2, "clk_periph_mmuart2", PARENT_CLK(AHB), 7, 0),
--
2.36.1
next prev parent reply other threads:[~2022-08-19 9:54 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-19 9:53 [PATCH v3 00/13] PolarFire SoC reset controller & clock cleanups Conor Dooley
2022-08-19 9:53 ` Conor Dooley [this message]
2022-08-19 9:53 ` [PATCH v3 02/13] dt-bindings: clk: microchip: mpfs: add reset controller support Conor Dooley
2022-08-19 9:53 ` [PATCH v3 03/13] clk: microchip: mpfs: add reset controller Conor Dooley
2022-08-30 6:40 ` Claudiu.Beznea
2022-08-30 6:44 ` Conor.Dooley
2022-08-19 9:53 ` [PATCH v3 04/13] reset: add polarfire soc reset support Conor Dooley
2022-08-19 9:53 ` [PATCH v3 05/13] MAINTAINERS: add polarfire soc reset controller Conor Dooley
2022-08-19 9:53 ` [PATCH v3 06/13] riscv: dts: microchip: add mpfs specific macb reset support Conor Dooley
2022-08-19 9:53 ` [PATCH v3 07/13] clk: microchip: mpfs: add MSS pll's set & round rate Conor Dooley
2022-08-19 9:53 ` [PATCH v3 08/13] clk: microchip: mpfs: move id & offset out of clock structs Conor Dooley
2022-08-19 9:53 ` [PATCH v3 09/13] clk: microchip: mpfs: simplify control reg access Conor Dooley
2022-08-19 9:53 ` [PATCH v3 10/13] clk: microchip: mpfs: delete 2 line mpfs_clk_register_foo() Conor Dooley
2022-08-19 9:53 ` [PATCH v3 11/13] clk: microchip: mpfs: convert cfg_clk to clk_divider Conor Dooley
2022-08-19 9:53 ` [PATCH v3 12/13] clk: microchip: mpfs: convert periph_clk to clk_gate Conor Dooley
2022-08-19 9:53 ` [PATCH v3 13/13] clk: microchip: mpfs: update module authorship & licencing Conor Dooley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220819095320.40006-2-conor.dooley@microchip.com \
--to=conor.dooley@microchip.com \
--cc=aou@eecs.berkeley.edu \
--cc=daire.mcnamara@microchip.com \
--cc=devicetree@vger.kernel.org \
--cc=krzysztof.kozlowski+dt@linaro.org \
--cc=linux-clk@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=mturquette@baylibre.com \
--cc=nathan@kernel.org \
--cc=p.zabel@pengutronix.de \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=robh+dt@kernel.org \
--cc=sboyd@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).