devm_regmap_field_alloc may fails, priv field might be error pointer and
cause illegal address access later.
Signed-off-by: Kang Chen <[email protected]>
---
drivers/hwspinlock/qcom_hwspinlock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwspinlock/qcom_hwspinlock.c b/drivers/hwspinlock/qcom_hwspinlock.c
index 9cf186362..b69d43d30 100644
--- a/drivers/hwspinlock/qcom_hwspinlock.c
+++ b/drivers/hwspinlock/qcom_hwspinlock.c
@@ -197,6 +197,8 @@ static int qcom_hwspinlock_probe(struct platform_device *pdev)
bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
regmap, field);
+ if (IS_ERR(bank->lock[i].priv)
+ return -ENOMEM;
}
return devm_hwspin_lock_register(&pdev->dev, bank, &qcom_hwspinlock_ops,
--
2.34.1
Hi Kang,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on v6.2]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Kang-Chen/hwspinlock-add-a-check-of-devm_regmap_field_alloc-in-qcom_hwspinlock_probe/20230226-224824
patch link: https://lore.kernel.org/r/20230226144545.4187442-1-void0red%40gmail.com
patch subject: [PATCH] hwspinlock: add a check of devm_regmap_field_alloc in qcom_hwspinlock_probe
config: arm-randconfig-r046-20230226 (https://download.01.org/0day-ci/archive/20230227/[email protected]/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b5a6ded03f6367c5e698c758864f3e569f1f762c
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Kang-Chen/hwspinlock-add-a-check-of-devm_regmap_field_alloc-in-qcom_hwspinlock_probe/20230226-224824
git checkout b5a6ded03f6367c5e698c758864f3e569f1f762c
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/hwspinlock/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All errors (new ones prefixed by >>):
drivers/hwspinlock/qcom_hwspinlock.c: In function 'qcom_hwspinlock_probe':
>> drivers/hwspinlock/qcom_hwspinlock.c:200:47: error: expected ')' before 'return'
200 | if (IS_ERR(bank->lock[i].priv)
| ~ ^
| )
201 | return -ENOMEM;
| ~~~~~~
>> drivers/hwspinlock/qcom_hwspinlock.c:202:9: error: expected expression before '}' token
202 | }
| ^
vim +200 drivers/hwspinlock/qcom_hwspinlock.c
168
169 static int qcom_hwspinlock_probe(struct platform_device *pdev)
170 {
171 struct hwspinlock_device *bank;
172 struct reg_field field;
173 struct regmap *regmap;
174 size_t array_size;
175 u32 stride;
176 u32 base;
177 int i;
178
179 regmap = qcom_hwspinlock_probe_syscon(pdev, &base, &stride);
180 if (IS_ERR(regmap) && PTR_ERR(regmap) == -ENODEV)
181 regmap = qcom_hwspinlock_probe_mmio(pdev, &base, &stride);
182
183 if (IS_ERR(regmap))
184 return PTR_ERR(regmap);
185
186 array_size = QCOM_MUTEX_NUM_LOCKS * sizeof(struct hwspinlock);
187 bank = devm_kzalloc(&pdev->dev, sizeof(*bank) + array_size, GFP_KERNEL);
188 if (!bank)
189 return -ENOMEM;
190
191 platform_set_drvdata(pdev, bank);
192
193 for (i = 0; i < QCOM_MUTEX_NUM_LOCKS; i++) {
194 field.reg = base + i * stride;
195 field.lsb = 0;
196 field.msb = 31;
197
198 bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
199 regmap, field);
> 200 if (IS_ERR(bank->lock[i].priv)
201 return -ENOMEM;
> 202 }
203
204 return devm_hwspin_lock_register(&pdev->dev, bank, &qcom_hwspinlock_ops,
205 0, QCOM_MUTEX_NUM_LOCKS);
206 }
207
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
Hi Kang,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on next-20230225]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Kang-Chen/hwspinlock-add-a-check-of-devm_regmap_field_alloc-in-qcom_hwspinlock_probe/20230226-224824
patch link: https://lore.kernel.org/r/20230226144545.4187442-1-void0red%40gmail.com
patch subject: [PATCH] hwspinlock: add a check of devm_regmap_field_alloc in qcom_hwspinlock_probe
config: hexagon-randconfig-r041-20230226 (https://download.01.org/0day-ci/archive/20230227/[email protected]/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project db89896bbbd2251fff457699635acbbedeead27f)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/b5a6ded03f6367c5e698c758864f3e569f1f762c
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Kang-Chen/hwspinlock-add-a-check-of-devm_regmap_field_alloc-in-qcom_hwspinlock_probe/20230226-224824
git checkout b5a6ded03f6367c5e698c758864f3e569f1f762c
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon SHELL=/bin/bash drivers/hwspinlock/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
| Link: https://lore.kernel.org/oe-kbuild-all/[email protected]/
All errors (new ones prefixed by >>):
In file included from drivers/hwspinlock/qcom_hwspinlock.c:8:
In file included from include/linux/io.h:13:
In file included from arch/hexagon/include/asm/io.h:334:
include/asm-generic/io.h:547:31: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __raw_readb(PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:560:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __le16_to_cpu((__le16 __force)__raw_readw(PCI_IOBASE + addr));
~~~~~~~~~~ ^
include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
#define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
^
In file included from drivers/hwspinlock/qcom_hwspinlock.c:8:
In file included from include/linux/io.h:13:
In file included from arch/hexagon/include/asm/io.h:334:
include/asm-generic/io.h:573:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __le32_to_cpu((__le32 __force)__raw_readl(PCI_IOBASE + addr));
~~~~~~~~~~ ^
include/uapi/linux/byteorder/little_endian.h:35:51: note: expanded from macro '__le32_to_cpu'
#define __le32_to_cpu(x) ((__force __u32)(__le32)(x))
^
In file included from drivers/hwspinlock/qcom_hwspinlock.c:8:
In file included from include/linux/io.h:13:
In file included from arch/hexagon/include/asm/io.h:334:
include/asm-generic/io.h:584:33: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writeb(value, PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:594:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writew((u16 __force)cpu_to_le16(value), PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:604:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writel((u32 __force)cpu_to_le32(value), PCI_IOBASE + addr);
~~~~~~~~~~ ^
>> drivers/hwspinlock/qcom_hwspinlock.c:201:4: error: expected ')'
return -ENOMEM;
^
drivers/hwspinlock/qcom_hwspinlock.c:200:6: note: to match this '('
if (IS_ERR(bank->lock[i].priv)
^
6 warnings and 1 error generated.
vim +201 drivers/hwspinlock/qcom_hwspinlock.c
168
169 static int qcom_hwspinlock_probe(struct platform_device *pdev)
170 {
171 struct hwspinlock_device *bank;
172 struct reg_field field;
173 struct regmap *regmap;
174 size_t array_size;
175 u32 stride;
176 u32 base;
177 int i;
178
179 regmap = qcom_hwspinlock_probe_syscon(pdev, &base, &stride);
180 if (IS_ERR(regmap) && PTR_ERR(regmap) == -ENODEV)
181 regmap = qcom_hwspinlock_probe_mmio(pdev, &base, &stride);
182
183 if (IS_ERR(regmap))
184 return PTR_ERR(regmap);
185
186 array_size = QCOM_MUTEX_NUM_LOCKS * sizeof(struct hwspinlock);
187 bank = devm_kzalloc(&pdev->dev, sizeof(*bank) + array_size, GFP_KERNEL);
188 if (!bank)
189 return -ENOMEM;
190
191 platform_set_drvdata(pdev, bank);
192
193 for (i = 0; i < QCOM_MUTEX_NUM_LOCKS; i++) {
194 field.reg = base + i * stride;
195 field.lsb = 0;
196 field.msb = 31;
197
198 bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
199 regmap, field);
200 if (IS_ERR(bank->lock[i].priv)
> 201 return -ENOMEM;
202 }
203
204 return devm_hwspin_lock_register(&pdev->dev, bank, &qcom_hwspinlock_ops,
205 0, QCOM_MUTEX_NUM_LOCKS);
206 }
207
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests
devm_regmap_field_alloc may fails, priv field might be error pointer and
cause illegal address access later.
Signed-off-by: Kang Chen <[email protected]>
---
v2 -> v1: add missing parenthesis and switch to use PTR_ERR
drivers/hwspinlock/qcom_hwspinlock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hwspinlock/qcom_hwspinlock.c b/drivers/hwspinlock/qcom_hwspinlock.c
index 9cf186362..dee7bb5ea 100644
--- a/drivers/hwspinlock/qcom_hwspinlock.c
+++ b/drivers/hwspinlock/qcom_hwspinlock.c
@@ -197,6 +197,8 @@ static int qcom_hwspinlock_probe(struct platform_device *pdev)
bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
regmap, field);
+ if (IS_ERR(bank->lock[i].priv))
+ return PTR_ERR(bank->lock[i].priv);
}
return devm_hwspin_lock_register(&pdev->dev, bank, &qcom_hwspinlock_ops,
--
2.34.1
On Mon, 27 Feb 2023 08:41:16 +0800, Kang Chen wrote:
> devm_regmap_field_alloc may fails, priv field might be error pointer and
> cause illegal address access later.
>
>
Applied, thanks!
[1/1] hwspinlock: add a check of devm_regmap_field_alloc in qcom_hwspinlock_probe
commit: 3c81195a04e13833196462ab398d8bcf282701f7
Best regards,
--
Bjorn Andersson <[email protected]>