1. 26 Sep, 2020 1 commit
  2. 16 Sep, 2020 1 commit
  3. 15 Sep, 2020 1 commit
  4. 14 Sep, 2020 4 commits
  5. 13 Sep, 2020 4 commits
  6. 11 Sep, 2020 1 commit
  7. 10 Sep, 2020 6 commits
  8. 09 Sep, 2020 1 commit
    • Sudeep Holla's avatar
      firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free · 6ed6c558
      Sudeep Holla authored
      scmi_mailbox is obtained from cinfo->transport_info and the first
      call to mailbox_chan_free frees the channel and sets cinfo->transport_info
      to NULL. Care is taken to check for non NULL smbox->chan but smbox can
      itself be NULL. Fix it by checking for it without which, kernel crashes
      with below NULL pointer dereference and eventually kernel panic.
      
         Unable to handle kernel NULL pointer dereference at
         		virtual address 0000000000000038
         Modules linked in: scmi_module(-)
         Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno
         		Development Platform, BIOS EDK II Sep  2 2020
         pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
         pc : mailbox_chan_free+0x2c/0x70 [scmi_module]
         lr : idr_for_each+0x6c/0xf8
         Call trace:
          mailbox_chan_free+0x2c/0x70 [scmi_module]
          idr_for_each+0x6c/0xf8
          scmi_remove+0xa8/0xf0 [scmi_module]
          platform_drv_remove+0x34/0x58
          device_release_driver_internal+0x118/0x1f0
          driver_detach+0x58/0xe8
          bus_remove_driver+0x64/0xe0
          driver_unregister+0x38/0x68
          platform_driver_unregister+0x1c/0x28
          scmi_driver_exit+0x38/0x44 [scmi_module]
         ---[ end trace 17bde19f50436de9 ]---
         Kernel panic - not syncing: Fatal exception
         SMP: stopping secondary CPUs
         Kernel Offset: 0x1d0000 from 0xffff800010000000
         PHYS_OFFSET: 0x80000000
         CPU features: 0x0240022,25806004
         Memory Limit: none
         ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      Link: https://lore.kernel.org/r/20200908112611.31515-1-sudeep.holla@arm.com
      Fixes: 5c8a47a5 ("firmware: arm_scmi: Make scmi core independent of the transport type")
      Cc: Cristian Marussi <cristian.marussi@arm.com>
      Cc: Viresh Kumar <viresh.kumar@linaro.org>
      Tested-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Reviewed-by: default avatarCristian Marussi <cristian.marussi@arm.com>
      Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
      Signed-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
      6ed6c558
  9. 08 Sep, 2020 2 commits
  10. 07 Sep, 2020 5 commits
  11. 06 Sep, 2020 1 commit
  12. 04 Sep, 2020 3 commits
  13. 02 Sep, 2020 5 commits
  14. 01 Sep, 2020 5 commits