From: Florian Fainelli <f.fainelli@gmail.com>
To: William Zhang <william.zhang@broadcom.com>,
Linux MTD List <linux-mtd@lists.infradead.org>
Cc: Broadcom Kernel List <bcm-kernel-feedback-list@broadcom.com>,
joel.peshkin@broadcom.com, miquel.raynal@bootlin.com,
dregan@mail.com, kamal.dasu@broadcom.com,
kursad.oney@broadcom.com,
Florian Fainelli <florian.fainelli@broadcom.com>,
linux-kernel@vger.kernel.org,
Vignesh Raghavendra <vigneshr@ti.com>,
Brian Norris <computersforpeace@gmail.com>,
Richard Weinberger <richard@nod.at>,
David Regan <dregan@broadcom.com>
Subject: Re: [PATCH] mtd: rawnand: brcmnand: Fix data access violation for STB chip
Date: Wed, 20 Mar 2024 20:28:23 -0700 [thread overview]
Message-ID: <8aa7d7ac-1c8e-4a8f-8d88-ffaadcbcafb8@gmail.com> (raw)
In-Reply-To: <20240320222623.35604-1-william.zhang@broadcom.com>
On 3/20/2024 3:26 PM, William Zhang wrote:
> Florian reported the following kernel NULL pointer dereference issue on
> a BCM7250 board:
> [ 2.829744] Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read
> [ 2.838740] [0000000c] *pgd=80000000004003, *pmd=00000000
> [ 2.844178] Internal error: Oops: 206 [#1] SMP ARM
> [ 2.848990] Modules linked in:
> [ 2.852061] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-next-20240305-gd95fcdf4961d #66
> [ 2.860436] Hardware name: Broadcom STB (Flattened Device Tree)
> [ 2.866371] PC is at brcmnand_read_by_pio+0x180/0x278
> [ 2.871449] LR is at __wait_for_common+0x9c/0x1b0
> [ 2.876178] pc : [<c094b6cc>] lr : [<c0e66310>] psr: 60000053
> [ 2.882460] sp : f0811a80 ip : 00000012 fp : 00000000
> [ 2.887699] r10: 00000000 r9 : 00000000 r8 : c3790000
> [ 2.892936] r7 : 00000000 r6 : 00000000 r5 : c35db440 r4 : ffe00000
> [ 2.899479] r3 : f15cb814 r2 : 00000000 r1 : 00000000 r0 : 00000000
>
> The issue only happens when dma mode is disabled or not supported on STB
> chip. The pio mode transfer calls brcmnand_read_data_bus function which
> dereferences ctrl->soc->read_data_bus. But the soc member in STB chip is
> NULL hence triggers the access violation. The function needs to check
> the soc pointer first.
>
> Fixes: 546e42599120 ("mtd: rawnand: brcmnand: Add BCMBCA read data bus interface")
>
> Reported-by: Florian Fainelli <florian.fainelli@broadcom.com>
> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
> Signed-off-by: William Zhang <william.zhang@broadcom.com>
Thanks for the quick fix William, I had missed that the difference
between systems was indeed FLASH_DMA being enabled or not.
--
Florian
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next prev parent reply other threads:[~2024-03-21 3:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-20 22:26 [PATCH] mtd: rawnand: brcmnand: Fix data access violation for STB chip William Zhang
2024-03-21 3:28 ` Florian Fainelli [this message]
2024-03-25 10:18 ` Miquel Raynal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8aa7d7ac-1c8e-4a8f-8d88-ffaadcbcafb8@gmail.com \
--to=f.fainelli@gmail.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=computersforpeace@gmail.com \
--cc=dregan@broadcom.com \
--cc=dregan@mail.com \
--cc=florian.fainelli@broadcom.com \
--cc=joel.peshkin@broadcom.com \
--cc=kamal.dasu@broadcom.com \
--cc=kursad.oney@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
--cc=vigneshr@ti.com \
--cc=william.zhang@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox