From: Aleksandr Mishin <amishin@t-argos.ru>
To: Rob Herring <robh@kernel.org>
Cc: "Aleksandr Mishin" <amishin@t-argos.ru>,
"Lorenzo Pieralisi" <lpieralisi@kernel.org>,
"Krzysztof Wilczyński" <kw@linux.com>,
"Bjorn Helgaas" <bhelgaas@google.com>,
"Manivannan Sadhasivam" <manivannan.sadhasivam@linaro.org>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
"Serge Semin" <fancer.lancer@gmail.com>,
"Niklas Cassel" <cassel@kernel.org>,
"Yoshihiro Shimoda" <yoshihiro.shimoda.uh@renesas.com>,
"Damien Le Moal" <dlemoal@kernel.org>,
"Siddharth Vadapalli" <s-vadapalli@ti.com>,
linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org,
"Bjorn Helgaas" <helgaas@kernel.org>
Subject: [PATCH v3] PCI: dwc: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs()
Date: Fri, 3 May 2024 15:57:26 +0300 [thread overview]
Message-ID: <20240503125726.46116-1-amishin@t-argos.ru> (raw)
In-Reply-To: <20240329051947.28900-1-amishin@t-argos.ru>
If IORESOURCE_MEM is not provided in Device Tree due to any error,
resource_list_first_type() will return NULL and
pci_parse_request_of_pci_ranges() will just emit a warning.
This will cause a NULL pointer dereference.
Fix this bug by adding NULL return check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources")
Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
Suggested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
v1->v2: Add return code processing as suggested by Bjorn
v2->v3: Return -ENODEV instead of -EINVAL as suggested by Manivannan
drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index 844de4418724..381f7b2b74ca 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -382,17 +382,22 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie)
} while (val & DBI_CS2);
}
-static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
+static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
{
u32 val;
u32 num_viewport = ks_pcie->num_viewport;
struct dw_pcie *pci = ks_pcie->pci;
struct dw_pcie_rp *pp = &pci->pp;
- u64 start, end;
+ struct resource_entry *ft;
struct resource *mem;
+ u64 start, end;
int i;
- mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res;
+ ft = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM);
+ if (!ft)
+ return -ENODEV;
+
+ mem = ft->res;
start = mem->start;
end = mem->end;
@@ -403,7 +408,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
ks_pcie_clear_dbi_mode(ks_pcie);
if (ks_pcie->is_am6)
- return;
+ return 0;
val = ilog2(OB_WIN_SIZE);
ks_pcie_app_writel(ks_pcie, OB_SIZE, val);
@@ -420,6 +425,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie)
val = ks_pcie_app_readl(ks_pcie, CMD_STATUS);
val |= OB_XLAT_EN_VAL;
ks_pcie_app_writel(ks_pcie, CMD_STATUS, val);
+
+ return 0;
}
static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus,
@@ -814,7 +821,10 @@ static int __init ks_pcie_host_init(struct dw_pcie_rp *pp)
return ret;
ks_pcie_stop_link(pci);
- ks_pcie_setup_rc_app_regs(ks_pcie);
+ ret = ks_pcie_setup_rc_app_regs(ks_pcie);
+ if (ret)
+ return ret;
+
writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8),
pci->dbi_base + PCI_IO_BASE);
--
2.30.2
next prev parent reply other threads:[~2024-05-03 13:00 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 5:19 [PATCH] PCI: dwc: keystone: Fix potential NULL dereference Aleksandr Mishin
2024-04-02 17:31 ` Bjorn Helgaas
2024-04-25 9:21 ` [PATCH v2] " Aleksandr Mishin
2024-04-25 13:00 ` Alexander Lobakin
2024-04-26 22:47 ` Bjorn Helgaas
2024-04-27 8:44 ` Manivannan Sadhasivam
2024-04-27 8:47 ` Manivannan Sadhasivam
2024-04-29 6:53 ` Niklas Cassel
2024-05-03 12:57 ` Aleksandr Mishin [this message]
2024-05-04 17:01 ` [PATCH v3] PCI: dwc: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() Manivannan Sadhasivam
2024-05-05 6:15 ` [PATCH v4] " Aleksandr Mishin
2024-05-17 17:13 ` Krzysztof Wilczyński
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240503125726.46116-1-amishin@t-argos.ru \
--to=amishin@t-argos.ru \
--cc=bhelgaas@google.com \
--cc=cassel@kernel.org \
--cc=dlemoal@kernel.org \
--cc=fancer.lancer@gmail.com \
--cc=helgaas@kernel.org \
--cc=kw@linux.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=lpieralisi@kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=manivannan.sadhasivam@linaro.org \
--cc=robh@kernel.org \
--cc=s-vadapalli@ti.com \
--cc=u.kleine-koenig@pengutronix.de \
--cc=yoshihiro.shimoda.uh@renesas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.