linux-pci.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
To: Rob Herring <robh@kernel.org>, Jingoo Han <jingoohan1@gmail.com>,
	Gustavo Pimentel <gustavo.pimentel@synopsys.com>,
	Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>,
	Bjorn Helgaas <bhelgaas@google.com>
Cc: PCI <linux-pci@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Jassi Brar <jaswinder.singh@linaro.org>,
	Masami Hiramatsu <masami.hiramatsu@linaro.org>,
	Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
Subject: Re: [PATCH v2] PCI: designware-ep: Fix the reference to pci->num_{ib,ob}_windows before setting
Date: Fri, 12 Feb 2021 16:44:34 +0900	[thread overview]
Message-ID: <216818ce-adee-3c08-7410-1d5d1ef5011c@socionext.com> (raw)
In-Reply-To: <CAL_JsqLtcXFktBWWqpbYf3B5BR2eUyBsQQ3Q5S3Ma8hn5T5Z0Q@mail.gmail.com>

Cc: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>

I found that this patch would cause null pointer dereference exception
when removing the function link.

If once linking the test function to the controller,
   # ln -s functions/pci_epf_test/test controllers/66000000.pcie-ep/

and unlinking it immediately,
   # rm controllers/66000000.pcie-ep/test

then the driver will occur null pointer access in dw_pcie_ep_clear_bar()
because ep->ib_window_map doesn't have a pointer to allocated memory yet.

To fix the original issue, I strongly recommend to apply Hou's patch [1]
instead of this patch.

Thank you,

[1] https://patchwork.kernel.org/project/linux-pci/patch/20210125044803.4310-1-Zhiqiang.Hou@nxp.com/

On 2021/01/21 0:20, Rob Herring wrote:
> On Mon, Jan 18, 2021 at 5:10 PM Kunihiko Hayashi
> <hayashi.kunihiko@socionext.com> wrote:
>>
>> The commit 281f1f99cf3a ("PCI: dwc: Detect number of iATU windows") gets
>> the values of pci->num_ib_windows and pci->num_ob_windows from iATU
>> registers instead of DT properties in dw_pcie_iatu_detect_regions*() or its
>> unroll version.
>>
>> However, before the values are set, the allocations in dw_pcie_ep_init()
>> refer them to determine the sizes of window_map. As a result, null pointer
>> dereference exception will occur when linking the EP function and the
>> controller.
>>
>>    # ln -s functions/pci_epf_test/test controllers/66000000.pcie-ep/
>>    Unable to handle kernel NULL pointer dereference at virtual address
>>    0000000000000010
>>
>> The call trace is as follows:
>>
>>    Call trace:
>>     _find_next_bit.constprop.1+0xc/0x88
>>     dw_pcie_ep_set_bar+0x78/0x1f8
>>     pci_epc_set_bar+0x9c/0xe8
>>     pci_epf_test_core_init+0xe8/0x220
>>     pci_epf_test_bind+0x1e0/0x378
>>     pci_epf_bind+0x54/0xb0
>>     pci_epc_epf_link+0x58/0x80
>>     configfs_symlink+0x1c0/0x570
>>     vfs_symlink+0xdc/0x198
>>     do_symlinkat+0xa0/0x110
>>     __arm64_sys_symlinkat+0x28/0x38
>>     el0_svc_common+0x84/0x1a0
>>     do_el0_svc+0x38/0x88
>>     el0_svc+0x1c/0x28
>>     el0_sync_handler+0x88/0xb0
>>     el0_sync+0x140/0x180
>>
>> The pci->num_{ib,ob}_windows should be referenced after they are set by
>> dw_pcie_iatu_detect_regions*() called from dw_pcie_setup().
>>
>> Cc: Rob Herring <robh@kernel.org>
>> Fixes: 281f1f99cf3a ("PCI: dwc: Detect number of iATU windows")
>> Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
>> ---
>>   drivers/pci/controller/dwc/pcie-designware-ep.c | 41 ++++++++++++-------------
>>   1 file changed, 20 insertions(+), 21 deletions(-)
> 
> Reviewed-by: Rob Herring <robh@kernel.org>
> 

-- 
---
Best Regards
Kunihiko Hayashi

      reply	other threads:[~2021-02-12  7:45 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-18 23:10 Kunihiko Hayashi
2021-01-20 15:20 ` Rob Herring
2021-02-12  7:44   ` Kunihiko Hayashi [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=216818ce-adee-3c08-7410-1d5d1ef5011c@socionext.com \
    --to=hayashi.kunihiko@socionext.com \
    --cc=Zhiqiang.Hou@nxp.com \
    --cc=bhelgaas@google.com \
    --cc=gustavo.pimentel@synopsys.com \
    --cc=jaswinder.singh@linaro.org \
    --cc=jingoohan1@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pci@vger.kernel.org \
    --cc=lorenzo.pieralisi@arm.com \
    --cc=masami.hiramatsu@linaro.org \
    --cc=robh@kernel.org \
    --subject='Re: [PATCH v2] PCI: designware-ep: Fix the reference to pci->num_{ib,ob}_windows before setting' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).