Luo Qiu
8be4e51f3e
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ]
Fix a kernel crash with the below call trace when the SCPI firmware
returns OPP count of zero.
dvfs_info.opp_count may be zero on some platforms during the reboot
test, and the kernel will crash after dereferencing the pointer to
kcalloc(info->count, sizeof(*opp), GFP_KERNEL).
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
| Mem abort info:
| ESR = 0x96000004
| Exception class = DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| Data abort info:
| ISV = 0, ISS = 0x00000004
| CM = 0, WnR = 0
| user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
| [0000000000000028] pgd=0000000000000000
| Internal error: Oops: 96000004 [#1] SMP
| scpi-hwmon: probe of PHYT000D:00 failed with error -110
| Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
| CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
| Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
| pstate: 60000005 (nZCv daif -PAN -UAO)
| pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
| lr : clk_register+0x438/0x720
| Call trace:
| scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
| devm_clk_hw_register+0x50/0xa0
| scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
| scpi_clocks_probe+0x528/0x70c [clk_scpi]
| platform_drv_probe+0x58/0xa8
| really_probe+0x260/0x3d0
| driver_probe_device+0x12c/0x148
| device_driver_attach+0x74/0x98
| __driver_attach+0xb4/0xe8
| bus_for_each_dev+0x88/0xe0
| driver_attach+0x30/0x40
| bus_add_driver+0x178/0x2b0
| driver_register+0x64/0x118
| __platform_driver_register+0x54/0x60
| scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
| do_one_initcall+0x54/0x220
| do_init_module+0x54/0x1c8
| load_module+0x14a4/0x1668
| __se_sys_finit_module+0xf8/0x110
| __arm64_sys_finit_module+0x24/0x30
| el0_svc_common+0x78/0x170
| el0_svc_handler+0x38/0x78
| el0_svc+0x8/0x340
| Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
| ---[ end trace 06feb22469d89fa8 ]---
| Kernel panic - not syncing: Fatal exception
| SMP: stopping secondary CPUs
| Kernel Offset: disabled
| CPU features: 0x10,a0002008
| Memory Limit: none
Fixes: 8cb7cf56c9 ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
Signed-off-by: Luo Qiu <luoqiu@kylinsec.com.cn>
Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
2024-12-14 19:44:24 +01:00 |
| .. |
|
accessibility
|
|
|
|
acpi
|
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
|
2024-12-14 19:44:22 +01:00 |
|
amba
|
|
|
|
android
|
binder: fix UAF caused by offsets overwrite
|
2024-09-12 11:03:55 +02:00 |
|
ata
|
ata: sata_sil: Rename sil_blacklist to sil_quirks
|
2024-11-08 16:20:38 +01:00 |
|
atm
|
atm: idt77252: prevent use after free in dequeue_rx()
|
2024-09-04 13:14:51 +02:00 |
|
auxdisplay
|
|
|
|
base
|
regmap: irq: Set lockdep class for hierarchical IRQ domains
|
2024-12-14 19:44:24 +01:00 |
|
bcma
|
|
|
|
block
|
aoe: fix the potential use-after-free problem in more places
|
2024-11-08 16:20:41 +01:00 |
|
bluetooth
|
Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
|
2024-11-08 16:20:48 +01:00 |
|
bus
|
|
|
|
cdrom
|
|
|
|
char
|
virtio_console: fix misc probe bugs
|
2024-11-08 16:20:43 +01:00 |
|
clk
|
clk: bcm: bcm53573: fix OF node leak in init
|
2024-11-08 16:20:44 +01:00 |
|
clocksource
|
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
|
2024-11-08 16:20:28 +01:00 |
|
connector
|
|
|
|
counter
|
|
|
|
cpufreq
|
cpufreq: exit() callback is optional
|
2024-06-16 13:28:34 +02:00 |
|
cpuidle
|
|
|
|
crypto
|
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
|
2024-12-14 19:44:23 +01:00 |
|
dax
|
|
|
|
dca
|
|
|
|
devfreq
|
|
|
|
dio
|
|
|
|
dma
|
dmaengine: ioatdma: Fix missing kmem_cache_destroy()
|
2024-07-05 09:08:23 +02:00 |
|
dma-buf
|
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
|
2024-06-16 13:28:47 +02:00 |
|
edac
|
EDAC/fsl_ddr: Fix bad bit shift operations
|
2024-12-14 19:44:23 +01:00 |
|
eisa
|
|
|
|
extcon
|
extcon: max8997: select IRQ_DOMAIN instead of depending on it
|
2024-06-16 13:28:43 +02:00 |
|
firewire
|
firewire: nosy: ensure user_length is taken into account when fetching packet contents
|
2024-05-17 11:43:54 +02:00 |
|
firmware
|
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
|
2024-12-14 19:44:24 +01:00 |
|
fpga
|
|
|
|
fsi
|
|
|
|
gnss
|
|
|
|
gpio
|
gpio: aspeed: Use devm_clk api to manage clock source
|
2024-11-08 16:20:45 +01:00 |
|
gpu
|
drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
|
2024-11-17 14:58:51 +01:00 |
|
greybus
|
greybus: Fix use-after-free bug in gb_interface_release due to race condition.
|
2024-07-05 09:08:20 +02:00 |
|
hid
|
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
|
2024-11-17 14:58:53 +01:00 |
|
hsi
|
|
|
|
hv
|
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
|
2024-09-12 11:03:55 +02:00 |
|
hwmon
|
hwmon: (ntc_thermistor) fix module autoloading
|
2024-11-08 16:20:28 +01:00 |
|
hwspinlock
|
|
|
|
hwtracing
|
coresight: tmc: sg: Do not leak sg_table
|
2024-11-08 16:20:32 +01:00 |
|
i2c
|
i2c: i801: Use a different adapter-name for IDF adapters
|
2024-11-08 16:20:44 +01:00 |
|
i3c
|
|
|
|
ide
|
|
|
|
idle
|
|
|
|
iio
|
iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
|
2024-11-08 16:20:48 +01:00 |
|
infiniband
|
RDMA/bnxt_re: Return more meaningful error
|
2024-11-08 16:20:49 +01:00 |
|
input
|
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
|
2024-11-08 16:20:43 +01:00 |
|
interconnect
|
|
|
|
iommu
|
iommu/vt-d: Handle volatile descriptor status read
|
2024-09-12 11:03:53 +02:00 |
|
ipack
|
|
|
|
irqchip
|
irqchip/gic-v3: Force propagation of the active state with a read-back
|
2024-11-17 14:58:52 +01:00 |
|
isdn
|
mISDN: Fix a use after free in hfcmulti_tx()
|
2024-08-19 05:33:42 +02:00 |
|
leds
|
leds: ss4200: Convert PCIBIOS_* return codes to errnos
|
2024-08-19 05:33:37 +02:00 |
|
lightnvm
|
|
|
|
macintosh
|
macintosh/therm_windtunnel: fix module unload.
|
2024-08-19 05:33:34 +02:00 |
|
mailbox
|
mailbox: bcm2835: Fix timeout during suspend mode
|
2024-11-08 16:20:35 +01:00 |
|
mcb
|
|
|
|
md
|
md/raid10: improve code of mrdev in raid10_sync_request
|
2024-11-17 14:58:53 +01:00 |
|
media
|
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
|
2024-12-14 19:44:19 +01:00 |
|
memory
|
|
|
|
memstick
|
|
|
|
message
|
|
|
|
mfd
|
mfd: omap-usb-tll: Use struct_size to allocate tll
|
2024-08-19 05:33:32 +02:00 |
|
misc
|
misc: sgi-gru: Don't disable preemption in GRU driver
|
2024-11-08 16:20:53 +01:00 |
|
mmc
|
mmc: mmc_spi: drop buggy snprintf()
|
2024-12-14 19:44:24 +01:00 |
|
mtd
|
mtd: rawnand: protect access to rawnand devices while in suspend
|
2024-11-17 14:58:51 +01:00 |
|
mux
|
|
|
|
net
|
net: usb: qmi_wwan: add Quectel RG650V
|
2024-12-14 19:44:20 +01:00 |
|
nfc
|
nfc: pn533: Add poll mod list filling check
|
2024-09-04 13:15:04 +02:00 |
|
ntb
|
ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
|
2024-11-08 16:20:44 +01:00 |
|
nubus
|
|
|
|
nvdimm
|
virtio_pmem: Check device status before requesting flush
|
2024-11-08 16:20:44 +01:00 |
|
nvme
|
nvme-pci: fix freeing of the HMB descriptor table
|
2024-12-14 19:44:22 +01:00 |
|
nvmem
|
nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
|
2024-09-12 11:03:55 +02:00 |
|
of
|
of/irq: Support #msi-cells=<0> in of_msi_get_domain
|
2024-11-08 16:20:40 +01:00 |
|
opp
|
|
|
|
oprofile
|
|
|
|
parisc
|
|
|
|
parport
|
parport: Proper fix for array out-of-bounds access
|
2024-11-08 16:20:49 +01:00 |
|
pci
|
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
|
2024-11-08 16:20:47 +01:00 |
|
pcmcia
|
pcmcia: Use resource_size function on resource object
|
2024-09-12 11:03:52 +02:00 |
|
perf
|
|
|
|
phy
|
|
|
|
pinctrl
|
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
|
2024-11-08 16:20:32 +01:00 |
|
platform
|
platform/x86: dell-smbios: Fix error path in dell_smbios_init()
|
2024-09-12 11:03:52 +02:00 |
|
pnp
|
|
|
|
power
|
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
|
2024-12-14 19:44:24 +01:00 |
|
powercap
|
|
|
|
pps
|
pps: add an error check in parport_attach
|
2024-11-08 16:20:35 +01:00 |
|
ps3
|
|
|
|
ptp
|
ptp: Fix error message on failed pin verification
|
2024-07-05 09:08:11 +02:00 |
|
pwm
|
pwm: imx-tpm: Use correct MODULO value for EPWM mode
|
2024-11-17 14:58:51 +01:00 |
|
rapidio
|
|
|
|
ras
|
|
|
|
regulator
|
regulator: rk808: Add apply_bit for BUCK3 on RK809
|
2024-12-14 19:44:20 +01:00 |
|
remoteproc
|
remoteproc: imx_rproc: Skip over memory region when node value is NULL
|
2024-08-19 05:33:44 +02:00 |
|
reset
|
reset: berlin: fix OF node leak in probe() error path
|
2024-11-08 16:20:28 +01:00 |
|
rpmsg
|
|
|
|
rtc
|
rtc: at91sam9: fix OF node leak in probe() error path
|
2024-11-08 16:20:42 +01:00 |
|
s390
|
s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
|
2024-11-08 16:20:48 +01:00 |
|
sbus
|
|
|
|
scsi
|
scsi: aacraid: Rearrange order of struct aac_srb_unit
|
2024-11-08 16:20:39 +01:00 |
|
sfi
|
|
|
|
sh
|
|
|
|
siox
|
|
|
|
slimbus
|
|
|
|
soc
|
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
|
2024-12-14 19:44:24 +01:00 |
|
soundwire
|
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
|
2024-11-08 16:20:25 +01:00 |
|
spi
|
spi: fix use-after-free of the add_lock mutex
|
2024-11-17 14:58:51 +01:00 |
|
spmi
|
|
|
|
ssb
|
ssb: Fix division by zero issue in ssb_calc_clock_rate
|
2024-09-04 13:14:53 +02:00 |
|
staging
|
staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
|
2024-11-08 16:20:53 +01:00 |
|
target
|
genetlink: hold RCU in genlmsg_mcast()
|
2024-11-08 16:20:50 +01:00 |
|
tc
|
|
|
|
tee
|
|
|
|
thermal
|
|
|
|
thunderbolt
|
|
|
|
tty
|
vt: prevent kernel-infoleak in con_font_get()
|
2024-11-08 16:20:54 +01:00 |
|
uio
|
Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
|
2024-09-12 11:03:55 +02:00 |
|
usb
|
USB: serial: option: add Quectel RG650V
|
2024-11-17 14:58:52 +01:00 |
|
vfio
|
|
|
|
vhost
|
|
|
|
video
|
fbdev: sisfb: Fix strbuf array overflow
|
2024-11-08 16:20:45 +01:00 |
|
virt
|
|
|
|
virtio
|
virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
|
2024-06-16 13:28:46 +02:00 |
|
visorbus
|
|
|
|
vlynq
|
|
|
|
vme
|
|
|
|
w1
|
|
|
|
watchdog
|
watchdog: imx_sc_wdt: Don't disable WDT in suspend
|
2024-11-08 16:20:32 +01:00 |
|
xen
|
xen/swiotlb: add alignment check for dma buffers
|
2024-11-08 16:20:30 +01:00 |
|
zorro
|
|
|
|
Kconfig
|
|
|
|
Makefile
|
|
|