| Message ID | 20240503125726.46116-1-amishin@t-argos.ru |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] PCI: dwc: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() | expand |
On Fri, May 03, 2024 at 03:57:26PM +0300, Aleksandr Mishin wrote: > If IORESOURCE_MEM is not provided in Device Tree due to any error, > resource_list_first_type() will return NULL and > pci_parse_request_of_pci_ranges() will just emit a warning. > This will cause a NULL pointer dereference. > Fix this bug by adding NULL return check. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") > Suggested-by: Bjorn Helgaas <helgaas@kernel.org> > Suggested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> One nitpick below. With that addressed, Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> > --- > v1->v2: Add return code processing as suggested by Bjorn > v2->v3: Return -ENODEV instead of -EINVAL as suggested by Manivannan > > drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- > 1 file changed, 15 insertions(+), 5 deletions(-) > > diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c > index 844de4418724..381f7b2b74ca 100644 > --- a/drivers/pci/controller/dwc/pci-keystone.c > +++ b/drivers/pci/controller/dwc/pci-keystone.c > @@ -382,17 +382,22 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) > } while (val & DBI_CS2); > } > > -static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) > +static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) > { > u32 val; > u32 num_viewport = ks_pcie->num_viewport; > struct dw_pcie *pci = ks_pcie->pci; > struct dw_pcie_rp *pp = &pci->pp; > - u64 start, end; > + struct resource_entry *ft; s/ft/entry - Mani > struct resource *mem; > + u64 start, end; > int i; > > - mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; > + ft = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); > + if (!ft) > + return -ENODEV; > + > + mem = ft->res; > start = mem->start; > end = mem->end; > > @@ -403,7 +408,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) > ks_pcie_clear_dbi_mode(ks_pcie); > > if (ks_pcie->is_am6) > - return; > + return 0; > > val = ilog2(OB_WIN_SIZE); > ks_pcie_app_writel(ks_pcie, OB_SIZE, val); > @@ -420,6 +425,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) > val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); > val |= OB_XLAT_EN_VAL; > ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); > + > + return 0; > } > > static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, > @@ -814,7 +821,10 @@ static int __init ks_pcie_host_init(struct dw_pcie_rp *pp) > return ret; > > ks_pcie_stop_link(pci); > - ks_pcie_setup_rc_app_regs(ks_pcie); > + ret = ks_pcie_setup_rc_app_regs(ks_pcie); > + if (ret) > + return ret; > + > writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), > pci->dbi_base + PCI_IO_BASE); > > -- > 2.30.2 > >
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c index 844de4418724..381f7b2b74ca 100644 --- a/drivers/pci/controller/dwc/pci-keystone.c +++ b/drivers/pci/controller/dwc/pci-keystone.c @@ -382,17 +382,22 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) } while (val & DBI_CS2); } -static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) +static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) { u32 val; u32 num_viewport = ks_pcie->num_viewport; struct dw_pcie *pci = ks_pcie->pci; struct dw_pcie_rp *pp = &pci->pp; - u64 start, end; + struct resource_entry *ft; struct resource *mem; + u64 start, end; int i; - mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; + ft = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); + if (!ft) + return -ENODEV; + + mem = ft->res; start = mem->start; end = mem->end; @@ -403,7 +408,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) ks_pcie_clear_dbi_mode(ks_pcie); if (ks_pcie->is_am6) - return; + return 0; val = ilog2(OB_WIN_SIZE); ks_pcie_app_writel(ks_pcie, OB_SIZE, val); @@ -420,6 +425,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); val |= OB_XLAT_EN_VAL; ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); + + return 0; } static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, @@ -814,7 +821,10 @@ static int __init ks_pcie_host_init(struct dw_pcie_rp *pp) return ret; ks_pcie_stop_link(pci); - ks_pcie_setup_rc_app_regs(ks_pcie); + ret = ks_pcie_setup_rc_app_regs(ks_pcie); + if (ret) + return ret; + writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), pci->dbi_base + PCI_IO_BASE);
If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") Suggested-by: Bjorn Helgaas <helgaas@kernel.org> Suggested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> --- v1->v2: Add return code processing as suggested by Bjorn v2->v3: Return -ENODEV instead of -EINVAL as suggested by Manivannan drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-)