| Message ID | 20240320222623.35604-1-william.zhang@broadcom.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | mtd: rawnand: brcmnand: Fix data access violation for STB chip | expand |
On 3/20/2024 3:26 PM, William Zhang wrote: > Florian reported the following kernel NULL pointer dereference issue on > a BCM7250 board: > [ 2.829744] Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read > [ 2.838740] [0000000c] *pgd=80000000004003, *pmd=00000000 > [ 2.844178] Internal error: Oops: 206 [#1] SMP ARM > [ 2.848990] Modules linked in: > [ 2.852061] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-next-20240305-gd95fcdf4961d #66 > [ 2.860436] Hardware name: Broadcom STB (Flattened Device Tree) > [ 2.866371] PC is at brcmnand_read_by_pio+0x180/0x278 > [ 2.871449] LR is at __wait_for_common+0x9c/0x1b0 > [ 2.876178] pc : [<c094b6cc>] lr : [<c0e66310>] psr: 60000053 > [ 2.882460] sp : f0811a80 ip : 00000012 fp : 00000000 > [ 2.887699] r10: 00000000 r9 : 00000000 r8 : c3790000 > [ 2.892936] r7 : 00000000 r6 : 00000000 r5 : c35db440 r4 : ffe00000 > [ 2.899479] r3 : f15cb814 r2 : 00000000 r1 : 00000000 r0 : 00000000 > > The issue only happens when dma mode is disabled or not supported on STB > chip. The pio mode transfer calls brcmnand_read_data_bus function which > dereferences ctrl->soc->read_data_bus. But the soc member in STB chip is > NULL hence triggers the access violation. The function needs to check > the soc pointer first. > > Fixes: 546e42599120 ("mtd: rawnand: brcmnand: Add BCMBCA read data bus interface") > > Reported-by: Florian Fainelli <florian.fainelli@broadcom.com> > Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> > Signed-off-by: William Zhang <william.zhang@broadcom.com> Thanks for the quick fix William, I had missed that the difference between systems was indeed FLASH_DMA being enabled or not.
On Wed, 2024-03-20 at 22:26:22 UTC, William Zhang wrote: > Florian reported the following kernel NULL pointer dereference issue on > a BCM7250 board: > [ 2.829744] Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read > [ 2.838740] [0000000c] *pgd=80000000004003, *pmd=00000000 > [ 2.844178] Internal error: Oops: 206 [#1] SMP ARM > [ 2.848990] Modules linked in: > [ 2.852061] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-next-20240305-gd95fcdf4961d #66 > [ 2.860436] Hardware name: Broadcom STB (Flattened Device Tree) > [ 2.866371] PC is at brcmnand_read_by_pio+0x180/0x278 > [ 2.871449] LR is at __wait_for_common+0x9c/0x1b0 > [ 2.876178] pc : [<c094b6cc>] lr : [<c0e66310>] psr: 60000053 > [ 2.882460] sp : f0811a80 ip : 00000012 fp : 00000000 > [ 2.887699] r10: 00000000 r9 : 00000000 r8 : c3790000 > [ 2.892936] r7 : 00000000 r6 : 00000000 r5 : c35db440 r4 : ffe00000 > [ 2.899479] r3 : f15cb814 r2 : 00000000 r1 : 00000000 r0 : 00000000 > > The issue only happens when dma mode is disabled or not supported on STB > chip. The pio mode transfer calls brcmnand_read_data_bus function which > dereferences ctrl->soc->read_data_bus. But the soc member in STB chip is > NULL hence triggers the access violation. The function needs to check > the soc pointer first. > > Fixes: 546e42599120 ("mtd: rawnand: brcmnand: Add BCMBCA read data bus interface") > > Reported-by: Florian Fainelli <florian.fainelli@broadcom.com> > Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> > Signed-off-by: William Zhang <william.zhang@broadcom.com> Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/fixes, thanks. Miquel
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c index a8d12c71f987..1b2ec0fec60c 100644 --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c @@ -857,7 +857,7 @@ static inline void brcmnand_read_data_bus(struct brcmnand_controller *ctrl, struct brcmnand_soc *soc = ctrl->soc; int i; - if (soc->read_data_bus) { + if (soc && soc->read_data_bus) { soc->read_data_bus(soc, flash_cache, buffer, fc_words); } else { for (i = 0; i < fc_words; i++)
Florian reported the following kernel NULL pointer dereference issue on a BCM7250 board: [ 2.829744] Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read [ 2.838740] [0000000c] *pgd=80000000004003, *pmd=00000000 [ 2.844178] Internal error: Oops: 206 [#1] SMP ARM [ 2.848990] Modules linked in: [ 2.852061] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-next-20240305-gd95fcdf4961d #66 [ 2.860436] Hardware name: Broadcom STB (Flattened Device Tree) [ 2.866371] PC is at brcmnand_read_by_pio+0x180/0x278 [ 2.871449] LR is at __wait_for_common+0x9c/0x1b0 [ 2.876178] pc : [<c094b6cc>] lr : [<c0e66310>] psr: 60000053 [ 2.882460] sp : f0811a80 ip : 00000012 fp : 00000000 [ 2.887699] r10: 00000000 r9 : 00000000 r8 : c3790000 [ 2.892936] r7 : 00000000 r6 : 00000000 r5 : c35db440 r4 : ffe00000 [ 2.899479] r3 : f15cb814 r2 : 00000000 r1 : 00000000 r0 : 00000000 The issue only happens when dma mode is disabled or not supported on STB chip. The pio mode transfer calls brcmnand_read_data_bus function which dereferences ctrl->soc->read_data_bus. But the soc member in STB chip is NULL hence triggers the access violation. The function needs to check the soc pointer first. Fixes: 546e42599120 ("mtd: rawnand: brcmnand: Add BCMBCA read data bus interface") Reported-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Signed-off-by: William Zhang <william.zhang@broadcom.com> --- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)