OpenCloudOS-Kernel/drivers/firmware
Luo Qiu 025067eeb9 firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ]

Fix a kernel crash with the below call trace when the SCPI firmware
returns OPP count of zero.

dvfs_info.opp_count may be zero on some platforms during the reboot
test, and the kernel will crash after dereferencing the pointer to
kcalloc(info->count, sizeof(*opp), GFP_KERNEL).

  |  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
  |  Mem abort info:
  |    ESR = 0x96000004
  |    Exception class = DABT (current EL), IL = 32 bits
  |    SET = 0, FnV = 0
  |    EA = 0, S1PTW = 0
  |  Data abort info:
  |    ISV = 0, ISS = 0x00000004
  |    CM = 0, WnR = 0
  |  user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
  |  [0000000000000028] pgd=0000000000000000
  |  Internal error: Oops: 96000004 [#1] SMP
  |  scpi-hwmon: probe of PHYT000D:00 failed with error -110
  |  Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
  |  CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
  |  Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
  |  pstate: 60000005 (nZCv daif -PAN -UAO)
  |  pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |  lr : clk_register+0x438/0x720
  |  Call trace:
  |   scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |   devm_clk_hw_register+0x50/0xa0
  |   scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
  |   scpi_clocks_probe+0x528/0x70c [clk_scpi]
  |   platform_drv_probe+0x58/0xa8
  |   really_probe+0x260/0x3d0
  |   driver_probe_device+0x12c/0x148
  |   device_driver_attach+0x74/0x98
  |   __driver_attach+0xb4/0xe8
  |   bus_for_each_dev+0x88/0xe0
  |   driver_attach+0x30/0x40
  |   bus_add_driver+0x178/0x2b0
  |   driver_register+0x64/0x118
  |   __platform_driver_register+0x54/0x60
  |   scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
  |   do_one_initcall+0x54/0x220
  |   do_init_module+0x54/0x1c8
  |   load_module+0x14a4/0x1668
  |   __se_sys_finit_module+0xf8/0x110
  |   __arm64_sys_finit_module+0x24/0x30
  |   el0_svc_common+0x78/0x170
  |   el0_svc_handler+0x38/0x78
  |   el0_svc+0x8/0x340
  |  Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
  |  ---[ end trace 06feb22469d89fa8 ]---
  |  Kernel panic - not syncing: Fatal exception
  |  SMP: stopping secondary CPUs
  |  Kernel Offset: disabled
  |  CPU features: 0x10,a0002008
  |  Memory Limit: none

Fixes: 8cb7cf56c9 ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
Signed-off-by: Luo Qiu <luoqiu@kylinsec.com.cn>
Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-09 10:31:58 +01:00
..
arm_ffa firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of messaging 2023-11-20 11:59:16 +01:00
arm_scmi firmware: arm_scmi: Reject clear channel request on A2P 2024-12-09 10:31:38 +01:00
broadcom MIPS: BCM47XX: remove MODULE_LICENSE in non-modules 2023-04-13 13:13:51 -07:00
cirrus firmware: cs_dsp: Don't allow writes to read-only controls 2024-09-12 11:11:35 +02:00
efi tpm: fix signed/unsigned bug when checking event logs 2024-12-09 10:31:53 +01:00
google firmware: google: Unregister driver_info on failure 2024-12-09 10:31:47 +01:00
imx firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() 2023-10-10 10:30:29 +08:00
meson firmware: meson_sm: fix to avoid potential NULL pointer dereference 2023-08-04 15:19:01 +02:00
psci firmware: psci: Fix return value from psci_system_suspend() 2024-06-27 13:49:10 +02:00
smccc arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint 2024-11-14 13:19:38 +01:00
tegra firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp() 2024-10-10 11:57:44 +02:00
xilinx Pin control bulk changes for the v6.6 kernel cycle: 2023-08-30 19:36:19 -07:00
Kconfig video: Add helpers for decoding screen_info 2024-08-11 12:47:15 +02:00
Makefile
arm_scpi.c firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 2024-12-09 10:31:58 +01:00
arm_sdei.c firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() 2024-11-08 16:28:20 +01:00
dmi-id.c firmware: dmi-id: add a release callback function 2024-06-12 11:12:15 +02:00
dmi-sysfs.c firmware: dmi-sysfs: handle HAS_IOPORT=n 2023-05-31 19:17:29 +01:00
dmi_scan.c firmware: dmi: Stop decoding on broken entry 2024-07-11 12:49:06 +02:00
edd.c edd: make kobj_type structure constant 2023-03-09 18:07:33 +01:00
iscsi_ibft.c
iscsi_ibft_find.c iscsi_ibft: Fix finding the iBFT under Xen Dom 0 2023-06-26 07:47:11 +02:00
memmap.c
mtk-adsp-ipc.c firmware: Explicitly include correct DT includes 2023-08-12 10:31:01 +02:00
pcdp.c
pcdp.h
qcom_scm-legacy.c firmware: qcom_scm: Move qcom_scm.h to include/linux/firmware/qcom/ 2023-02-08 19:15:16 -08:00
qcom_scm-smc.c firmware: qcom: scm: Mark get_wq_ctx() as atomic call 2024-09-04 13:28:28 +02:00
qcom_scm.c firmware: qcom_scm: disable clocks if qcom_scm_bw_enable() fails 2024-06-21 14:38:21 +02:00
qcom_scm.h firmware: qcom: scm: Add wait-queue handling logic 2023-01-18 21:14:40 -06:00
qemu_fw_cfg.c
raspberrypi.c firmware: raspberrypi: Use correct device for DMA mappings 2024-06-12 11:11:31 +02:00
scpi_pm_domain.c firmware: Explicitly include correct DT includes 2023-08-12 10:31:01 +02:00
stratix10-rsu.c Char/Misc driver changes for 6.6-rc1 2023-09-01 09:53:54 -07:00
stratix10-svc.c firmware: stratix10-svc: Generic Mailbox Command 2023-08-04 16:31:37 +02:00
sysfb.c firmware/sysfb: Update screen_info for relocated EFI framebuffers 2024-08-11 12:47:16 +02:00
sysfb_simplefb.c firmware/sysfb: Fix VESA format selection 2023-04-21 14:27:31 +02:00
ti_sci.c firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() 2024-01-25 15:35:20 -08:00
ti_sci.h
trusted_foundations.c
turris-mox-rwtm.c firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-08-03 08:53:35 +02:00