kernel_samsung_a53x/drivers/firmware
Luo Qiu 26f3aa22d6 firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
[ Upstream commit 109aa654f85c5141e813b2cd1bd36d90be678407 ]

Fix a kernel crash with the below call trace when the SCPI firmware
returns OPP count of zero.

dvfs_info.opp_count may be zero on some platforms during the reboot
test, and the kernel will crash after dereferencing the pointer to
kcalloc(info->count, sizeof(*opp), GFP_KERNEL).

  |  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
  |  Mem abort info:
  |    ESR = 0x96000004
  |    Exception class = DABT (current EL), IL = 32 bits
  |    SET = 0, FnV = 0
  |    EA = 0, S1PTW = 0
  |  Data abort info:
  |    ISV = 0, ISS = 0x00000004
  |    CM = 0, WnR = 0
  |  user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c
  |  [0000000000000028] pgd=0000000000000000
  |  Internal error: Oops: 96000004 [#1] SMP
  |  scpi-hwmon: probe of PHYT000D:00 failed with error -110
  |  Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c)
  |  CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1
  |  Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS
  |  pstate: 60000005 (nZCv daif -PAN -UAO)
  |  pc : scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |  lr : clk_register+0x438/0x720
  |  Call trace:
  |   scpi_dvfs_recalc_rate+0x40/0x58 [clk_scpi]
  |   devm_clk_hw_register+0x50/0xa0
  |   scpi_clk_ops_init.isra.2+0xa0/0x138 [clk_scpi]
  |   scpi_clocks_probe+0x528/0x70c [clk_scpi]
  |   platform_drv_probe+0x58/0xa8
  |   really_probe+0x260/0x3d0
  |   driver_probe_device+0x12c/0x148
  |   device_driver_attach+0x74/0x98
  |   __driver_attach+0xb4/0xe8
  |   bus_for_each_dev+0x88/0xe0
  |   driver_attach+0x30/0x40
  |   bus_add_driver+0x178/0x2b0
  |   driver_register+0x64/0x118
  |   __platform_driver_register+0x54/0x60
  |   scpi_clocks_driver_init+0x24/0x1000 [clk_scpi]
  |   do_one_initcall+0x54/0x220
  |   do_init_module+0x54/0x1c8
  |   load_module+0x14a4/0x1668
  |   __se_sys_finit_module+0xf8/0x110
  |   __arm64_sys_finit_module+0x24/0x30
  |   el0_svc_common+0x78/0x170
  |   el0_svc_handler+0x38/0x78
  |   el0_svc+0x8/0x340
  |  Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820)
  |  ---[ end trace 06feb22469d89fa8 ]---
  |  Kernel panic - not syncing: Fatal exception
  |  SMP: stopping secondary CPUs
  |  Kernel Offset: disabled
  |  CPU features: 0x10,a0002008
  |  Memory Limit: none

Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol")
Signed-off-by: Luo Qiu <luoqiu@kylinsec.com.cn>
Message-Id: <55A2F7A784391686+20241101032115.275977-1-luoqiu@kylinsec.com.cn>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-17 13:24:03 +01:00
..
arm_scmi
broadcom
efi tpm: fix signed/unsigned bug when checking event logs 2024-12-17 13:24:00 +01:00
google firmware: google: Unregister driver_info on failure 2024-12-17 13:23:59 +01:00
imx
meson firmware: meson_sm: populate platform devices from sm device tree data 2024-11-18 12:12:28 +01:00
psci
smccc
tegra Revert "firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()" 2024-11-24 00:23:05 +01:00
xilinx
arm_scpi.c firmware: arm_scpi: Check the DVFS OPP count returned by the firmware 2024-12-17 13:24:03 +01:00
arm_sdei.c
dmi-id.c firmware: dmi-id: add a release callback function 2024-11-19 12:27:01 +01:00
dmi-sysfs.c
dmi_scan.c firmware: dmi: Stop decoding on broken entry 2024-11-19 14:19:40 +01:00
edd.c
iscsi_ibft.c
iscsi_ibft_find.c
Kconfig
Makefile
memmap.c
pcdp.c
pcdp.h
qcom_scm-legacy.c
qcom_scm-smc.c
qcom_scm.c
qcom_scm.h
qemu_fw_cfg.c
raspberrypi.c firmware: raspberrypi: Use correct device for DMA mappings 2024-11-19 12:26:52 +01:00
scpi_pm_domain.c
stratix10-rsu.c
stratix10-svc.c
ti_sci.c
ti_sci.h
trusted_foundations.c
turris-mox-rwtm.c firmware: turris-mox-rwtm: Initialize completion before mailbox 2024-11-23 23:20:06 +01:00