- 22 May, 2020 16 commits
-
-
Jeffrey Hugo authored
The MHI device may be in the syserr state when we attempt to init it in power_up(). Since we have no local state, the handling is simple - reset the device and wait for it to transition out of the reset state. Signed-off-by:
Jeffrey Hugo <jhugo@codeaurora.org> Reviewed-by:
Hemant Kumar <hemantk@codeaurora.org> Reviewed-by:
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Hemant Kumar authored
Take write lock only to protect db_mode member of mhi channel. This allows rest of the mhi channels to just take read lock which fine grains the locking. It prevents channel readers to starve if they try to enter critical section after a writer. Signed-off-by:
-
Hemant Kumar authored
Devices that support RDDM do not require processing SYS_ERROR as it is deemed redundant. Avoid SYS_ERROR processing if RDDM is supported by the device. Signed-off-by:
-
Hemant Kumar authored
Driver continues handling of BHI interrupt even if MHI register access is not allowed. By doing so it calls the status call back and performs early notification for the MHI client. This is not needed when MHI register access is not allowed. Hence skip the handling in this case and return. Also add debug log to print device state, local EE and device EE when reg access is valid. Signed-off-by:
-
Hemant Kumar authored
Mission mode transition is handled by state worker thread but power off is not. There is a possibility while mission mode transition is in progress which calls MHI client driver probe, power off is issued by MHI controller. This results into client driver probe and remove running in parallel and causes use after free situation. By queuing disable transition work when mission mode is in progress prevents the race condition. Signed-off-by:
-
Hemant Kumar authored
Remove the system error worker thread and instead have the execution environment worker handle that transition to serialize processing and avoid any possible race conditions during shutdown. Signed-off-by:
-
Bhaumik Bhatt authored
While writing any sequence or session identifiers, it is possible that the host could write a zero value, whereas only non-zero values should be supported writes to those registers. Ensure that the host does not write a non-zero value for them and also log them in debug messages. A macro is introduced to simplify this check and the existing checks are also converted to use this macro. Signed-off-by:
Bhaumik Bhatt <bbhatt@codeaurora.org> Reviewed-by:
-
Bhaumik Bhatt authored
Add log messages to track boot flow errors and timeouts in SBL or AMSS firmware loading to aid in debug. Signed-off-by:
-
Bhaumik Bhatt authored
When loading AMSS firmware using BHIe protocol, return -ETIMEDOUT if no response is received within the timeout or return -EIO in case of a protocol returned failure or an MHI error state. Signed-off-by:
-
Bhaumik Bhatt authored
Upon power up, driver queues firmware worker thread if the execution environment is PBL. Firmware worker is blocked with a timeout until state worker gets a chance to run and unblock firmware worker. An endpoint power up failure can be seen if state worker gets a chance to run after firmware worker has timed out. Remove this dependency and handle firmware load directly using state worker thread. Signed-off-by:
-
Hemant Kumar authored
When MHI Driver receives an EOT event, it reads xfer_len from the event in the last TRE. The value is under control of the MHI device and never validated by Host MHI driver. The value should never be larger than the real size of the buffer but a malicious device can set the value 0xFFFF as maximum. This causes driver to memory overflow (both read or write). Fix this issue by reading minimum of transfer length from event and the buffer length provided. Signed-off-by:
-
Hemant Kumar authored
MHI data completion handler function reads channel id from event ring element. Value is under the control of MHI devices and can be any value between 0 and 255. In order to prevent out of bound access add a bound check against the max channel supported by controller and skip processing of that event ring element. Signed-off-by:
-
Hemant Kumar authored
Driver is using zero initialized intmod value from mhi channel when configuring TRE for bei field. This prevents interrupt moderation to take effect in case it is supported by an event ring. Fix this by copying intmod value from associated event ring to mhi channel upon registering mhi controller. Signed-off-by:
-
Hemant Kumar authored
Move all the common code to generate TRE from mhi_queue_buf, mhi_queue_dma and mhi_queue_skb to mhi_gen_tre. This helps to centralize the TRE generation code which makes any future bug fixing easier to manage in these APIs. Suggested-by:
-
Greg Kroah-Hartman authored
Merge tag 'soundwire-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire into char-misc-next Vinod writes: soundwire updates for v5.8-rc1 This contains sdw_master_device patches and other updates done by Intel folks. Details: - sdw_master_device to represent the master instances. - sysfs properties for sdw_master_device and sdw_slave. - Documentation update for TDM modes. - some code cleanup patches and odd updates. * tag 'soundwire-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: intel: use a single module soundwire: fix spelling mistake soundwire: fix trailing line in sysfs_slave.c soundwire: add Slave sysfs support soundwire: master: add sysfs support soundwire: disco: s/ch/channels/ soundwire: master: add runtime pm support soundwire: bus_type: add sdw_master_device support soundwire: bus: add unique bus id soundwire: bus_type: introduce sdw_slave_type and sdw_master_type soundwire: bus: rename sdw_bus_master_add/delete, add arguments soundwire: intel: (cosmetic) remove multiple superfluous "else" statements soundwire: (cosmetic) remove multiple superfluous "else" statements soundwire: qcom: Use IRQF_ONESHOT soundwire: bus: reduce verbosity on enumeration soundwire: debugfs: clarify SDPX license with GPL-2.0-only soundwire: slave: don't init debugfs on device registration error Documentation: SoundWire: clarify TDM mode support soundwire: qcom: fix error handling in probe soundwire: intel: use asoc_rtd_to_cpu() / asoc_rtd_to_codec() macro for DAI pointer
-
https://git.linaro.org/people/georgi.djakov/linuxGreg Kroah-Hartman authored
Georgi writes: interconnect changes for 5.8 These are the interconnect changes for the 5.8-rc1 merge window: Core changes: - Convert the framework core from tristate to bool to make handling dependencies between other core frameworks easier - Add of_icc_get_by_index() - Add devm_of_icc_get() helper function - Add icc_enable() and icc_disable() helpers New drivers: - Platform driver for NXP i.MX8MM SoC - Platform driver for NXP i.MX8MN SoC - Platform driver for NXP i.MX8MQ SoC Signed-off-by:
Georgi Djakov <georgi.djakov@linaro.org> * tag 'icc-5.8-rc1' of https://git.linaro.org/people/georgi.djakov/linux: interconnect: Remove unused module exit code from core interconnect: Disallow interconnect core to be built as a module interconnect: Add of_icc_get_by_index() helper function interconnect: Add helpers for enabling/disabling a path interconnect: imx: Fix return value check in imx_icc_node_init_qos() interconnect: imx: Add platform driver for imx8mn interconnect: imx: Add platform driver for imx8mq interconnect: imx: Add platform driver for imx8mm interconnect: Add imx core driver dt-bindings: interconnect: Add bindings for imx8m noc interconnect: Add devm_of_icc_get() as exported API for users
-
- 21 May, 2020 2 commits
-
-
Colin Ian King authored
The variable ret is being initialized with a value that is never read and it is being updated later with a new value. The initialization is redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by:Colin Ian King <colin.king@canonical.com> Link: https://lore.kernel.org/r/20200519154553.873413-1-colin.king@canonical.comSigned-off-by:
-
Dan Carpenter authored
The problem is that we change "p_args" to point to the middle of the string so when we free it at the end of the function it's not freeing the same pointer that we originally allocated. Fixes: e2c94d6f ("w1_therm: adding alarm sysfs entry") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20200520120019.GA172354@mwandaSigned-off-by:
-
- 20 May, 2020 6 commits
-
-
Rander Wang authored
It's not clear why we have two modules for the Intel controller/master support when there is a single Kconfig. This adds complexity for no good reason, the two parts need to work together anyways. Signed-off-by:
Rander Wang <rander.wang@intel.com> Signed-off-by:
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by:
Bard Liao <yung-chuan.liao@linux.intel.com> Link: https://lore.kernel.org/r/20200519191903.6557-1-yung-chuan.liao@linux.intel.comSigned-off-by:
Vinod Koul <vkoul@kernel.org>
-
Vinod Koul authored
Fix typo for paranoia spelled as paranioa Fixes: bcac5902 ("soundwire: add Slave sysfs support") Signed-off-by:
-
Vinod Koul authored
Commit bcac5902 ("soundwire: add Slave sysfs support") added trailing line in file sysfs_slave.c, so remove it Fixes: bcac5902 ("soundwire: add Slave sysfs support") Signed-off-by:
-
Pierre-Louis Bossart authored
Expose MIPI DisCo Slave properties in sysfs. For Slave properties and Data Port 0, the attributes are managed with simple devm_ support. A Slave Device may have more than one Data Port (DPN), and each Data Port can be sink or source. The attributes are created dynamically using pre-canned macros, but still use devm_ with a name attribute group to avoid creating kobjects - as requested by GregKH. In the _show function, we use container_of() to retrieve port number and direction required to extract the information. Audio modes are not supported for now. Depending on the discussions the SoundWire Device Class, we may add it later as is or follow the new specification. Signed-off-by:
-
Pierre-Louis Bossart authored
Add the master properties as attributes. The description is directly derived from the MIPI DisCo specification. Credits: this patch is based on an earlier internal contribution by Vinod Koul, Sanyog Kale, Shreyas Nc and Hardik Shah. Signed-off-by:
-
Pierre-Louis Bossart authored
Use more meaningful member names in preparation for sysfs support. No functionality change. Signed-off-by:
-
- 19 May, 2020 16 commits
-
-
Souptick Joarder authored
Corrected error handling goto sequnece. Level put_pages should be called when pinned pages >= 0 && pinned != npages. Level free_pages should be called when pinned pages < 0. Fixes: fa8dda1e ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support") Signed-off-by:
Souptick Joarder <jrdr.linux@gmail.com> Acked-by:
Wu Hao <hao.wu@intel.com> Reviewed-by:
Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/1589825991-3545-1-git-send-email-jrdr.linux@gmail.comSigned-off-by:
-
Lad Prabhakar authored
Add Renesas R8A774C0 in pci_device_id table so that pci-epf-test can be used for testing PCIe EP on RZ/G2E. Signed-off-by:
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by:
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Link: https://lore.kernel.org/r/1589493809-2602-1-git-send-email-prabhakar.mahadev-lad.rj@bp.renesas.comSigned-off-by:
-
John Hubbard authored
This code was using get_user_pages*(), in a "Case 2" scenario (DMA/RDMA), using the categorization from [1]. That means that it's time to convert the get_user_pages*() + put_page() calls to pin_user_pages*() + unpin_user_pages() calls. There is some helpful background in [2]: basically, this is a small part of fixing a long-standing disconnect between pinning pages, and file systems' use of those pages. [1] Documentation/core-api/pin_user_pages.rst [2] "Explicit pinning of user-space pages": https://lwn.net/Articles/807108/ Cc: Frank Haverkamp <haver@linux.ibm.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:John Hubbard <jhubbard@nvidia.com> Link: https://lore.kernel.org/r/20200518015237.1568940-1-jhubbard@nvidia.comSigned-off-by:
-
John Hubbard authored
This code was using get_user_pages*(), in a "Case 2" scenario (DMA/RDMA), using the categorization from [1]. That means that it's time to convert the get_user_pages*() + put_page() calls to pin_user_pages*() + unpin_user_pages() calls. There is some helpful background in [2]: basically, this is a small part of fixing a long-standing disconnect between pinning pages, and file systems' use of those pages. Note that this effectively changes the code's behavior as well: it now ultimately calls set_page_dirty_lock(), instead of SetPageDirty(). This is probably more accurate. As Christoph Hellwig put it, "set_page_dirty() is only safe if we are dealing with a file backed page where we have reference on the inode it hangs off." [3] [1] Documentation/core-api/pin_user_pages.rst [2] "Explicit pinning of user-space pages": https://lwn.net/Articles/807108/ [3] https://lore.kernel.org/r/20190723153640.GB720@lst.deSigned-off-by: -
Mike Leach authored
Adds a notify callback for CPU PM events to the CTI driver - for CPU bound CTI devices. Signed-off-by:
Mike Leach <mike.leach@linaro.org> Signed-off-by:
Mathieu Poirier <mathieu.poirier@linaro.org> Link: https://lore.kernel.org/r/20200518180242.7916-24-mathieu.poirier@linaro.orgSigned-off-by:
-
Mike Leach authored
Adds registration of CPU start and stop functions to CPU hotplug mechanisms - for any CPU bound CTI. Sets CTI powered flag according to state. Will enable CTI on CPU start if there are existing enable requests. Signed-off-by:
-
Suzuki K Poulose authored
etm probe could be deferred due to the dependency in the trace path chain and may be retried. We need to clear the per-cpu etmdrvdata entry for the etm in case of a failure to avoid use-after-free cases as reported below: KASAN use-after-free bug in etm4_cpu_pm_notify(): [ 8.574566] coresight etm0: CPU0: ETM v4.2 initialized [ 8.581920] BUG: KASAN: use-after-free in etm4_cpu_pm_notify+0x580/0x2024 [ 8.581925] Read of size 8 at addr ffffff813304f8c8 by task swapper/3/0 [ 8.581927] [ 8.581934] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G S W 5.4.28 #314 [ 8.587775] coresight etm1: CPU1: ETM v4.2 initialized [ 8.594195] Call trace: [ 8.594205] dump_backtrace+0x0/0x188 [ 8.594209] show_stack+0x20/0x2c [ 8.594216] dump_stack+0xdc/0x144 [ 8.594227] print_address_description+0x3c/0x494 [ 8.594232] __kasan_report+0x144/0x168 [ 8.601598] coresight etm2: CPU2: ETM v4.2 initialized [ 8.602563] kasan_report+0x10/0x18 [ 8.602568] check_memory_region+0x1a4/0x1b4 [ 8.602572] __kasan_check_read+0x18/0x24 [ 8.602577] etm4_cpu_pm_notify+0x580/0x2024 [ 8.665945] notifier_call_chain+0x5c/0x90 [ 8.670166] __atomic_notifier_call_chain+0x90/0xf8 [ 8.675182] cpu_pm_notify+0x40/0x6c [ 8.678858] cpu_pm_enter+0x38/0x80 [ 8.682451] psci_enter_idle_state+0x34/0x70 [ 8.686844] cpuidle_enter_state+0xb8/0x20c [ 8.691143] cpuidle_enter+0x38/0x4c [ 8.694820] call_cpuidle+0x3c/0x68 [ 8.698408] do_idle+0x1a0/0x280 [ 8.701729] cpu_startup_entry+0x24/0x28 [ 8.705768] secondary_start_kernel+0x15c/0x170 [ 8.710423] [ 8.711972] Allocated by task 242: [ 8.715473] __kasan_kmalloc+0xf0/0x1ac [ 8.719426] kasan_slab_alloc+0x14/0x1c [ 8.723375] __kmalloc_track_caller+0x23c/0x388 [ 8.728040] devm_kmalloc+0x38/0x94 [ 8.731632] etm4_probe+0x48/0x3c8 [ 8.735140] amba_probe+0xbc/0x158 [ 8.738645] really_probe+0x144/0x408 [ 8.742412] driver_probe_device+0x70/0x140 [ 8.746716] __device_attach_driver+0x9c/0x110 [ 8.751287] bus_for_each_drv+0x90/0xd8 [ 8.755236] __device_attach+0xb4/0x164 [ 8.759188] device_initial_probe+0x20/0x2c [ 8.763490] bus_probe_device+0x34/0x94 [ 8.767436] device_add+0x34c/0x3e0 [ 8.771029] amba_device_try_add+0x68/0x440 [ 8.775332] amba_deferred_retry_func+0x48/0xc8 [ 8.779997] process_one_work+0x344/0x648 [ 8.784127] worker_thread+0x2ac/0x47c [ 8.787987] kthread+0x128/0x138 [ 8.791313] ret_from_fork+0x10/0x18 [ 8.794993] [ 8.796532] Freed by task 242: [ 8.799684] __kasan_slab_free+0x15c/0x22c [ 8.803897] kasan_slab_free+0x10/0x1c [ 8.807761] kfree+0x25c/0x4bc [ 8.810913] release_nodes+0x240/0x2b0 [ 8.814767] devres_release_all+0x3c/0x54 [ 8.818887] really_probe+0x178/0x408 [ 8.822661] driver_probe_device+0x70/0x140 [ 8.826963] __device_attach_driver+0x9c/0x110 [ 8.831539] bus_for_each_drv+0x90/0xd8 [ 8.835487] __device_attach+0xb4/0x164 [ 8.839431] device_initial_probe+0x20/0x2c [ 8.843732] bus_probe_device+0x34/0x94 [ 8.847678] device_add+0x34c/0x3e0 [ 8.851274] amba_device_try_add+0x68/0x440 [ 8.855576] amba_deferred_retry_func+0x48/0xc8 [ 8.860240] process_one_work+0x344/0x648 [ 8.864366] worker_thread+0x2ac/0x47c [ 8.868228] kthread+0x128/0x138 [ 8.871557] ret_from_fork+0x10/0x18 [ 8.875231] [ 8.876782] The buggy address belongs to the object at ffffff813304f800 [ 8.876782] which belongs to the cache kmalloc-1k of size 1024 [ 8.889632] The buggy address is located 200 bytes inside of [ 8.889632] 1024-byte region [ffffff813304f800, ffffff813304fc00) [ 8.901761] The buggy address belongs to the page: [ 8.906695] page:ffffffff04ac1200 refcount:1 mapcount:0 mapping:ffffff8146c03800 index:0x0 compound_mapcount: 0 [ 8.917047] flags: 0x4000000000010200(slab|head) [ 8.921799] raw: 4000000000010200 dead000000000100 dead000000000122 ffffff8146c03800 [ 8.929753] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 8.937703] page dumped because: kasan: bad access detected [ 8.943433] [ 8.944974] Memory state around the buggy address: [ 8.949903] ffffff813304f780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 8.957320] ffffff813304f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.964742] >ffffff813304f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.972157] ^ [ 8.977886] ffffff813304f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.985298] ffffff813304f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 8.992713] ================================================================== Fixes: f188b5e7 ("coresight: etm4x: Save/restore state across CPU low power states") Reported-by:
Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org> Tested-by:
Suzuki K Poulose <suzuki.poulose@arm.com> Signed-off-by:
-
Stephen Boyd authored
We don't need to cast void pointers, such as the amba_id data. Assign to a local variable to make the code prettier and also return NULL instead of 0 to make sparse happy. Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Reviewed-by:
Joe Perches <joe@perches.com> Signed-off-by:
Stephen Boyd <swboyd@chromium.org> Reviewed-by:
-
Stephen Boyd authored
We should include headers that C files use in the C files that use them and avoid relying on implicit includes as much as possible. This helps avoid compiler errors in the future about missing declarations when header files change includes in the future. Cc: Douglas Anderson <dianders@chromium.org> Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Signed-off-by:
-
Stephen Boyd authored
Sparse gets annoyed when this initializer is 0 but the first struct member is a pointer. Just use { } to initialize instead so that sparse is quiet. Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Signed-off-by: -
Stephen Boyd authored
These variables are assigned again before they're used. Leave them unassigned at first so that the compiler can detect problems in the future with use before initialization. Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Signed-off-by:
-
Stephen Boyd authored
These functions aren't used outside the file they're in. Mark them static to indicate as such and silence tools like sparse. Cc: Suzuki K Poulose <suzuki.poulose@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Signed-off-by:
-
Anurag Koul authored
Add PID for Arm Neoverse N1 ETM to the list of supported/known ETMs. Signed-off-by:
Anurag Koul <anurag.koul@arm.com> Signed-off-by:
-
Mike Leach authored
Differing default states set on driver init / perf init and as a result of a sysfs reset. The ETMv4 can be programmed to trace the entire instruction address range without the need to use address comparator filter resources. (Described in the ETMv4.x technical reference manual) sysfs reset was using this method, perf and default driver init were setup with an address range comparator for the entire address range. The perf / driver init has been altered to use the method without needing any comparator address hardware. Minor adjustment to the vinst_ctrl register initialisation to ensure correct zero initialisation. Signed-off-by:
-
Sai Prakash Ranjan authored
On some QCOM platforms like SC7180, SDM845 and SM8150, reading TMC mode register without proper coresight power management can lead to async exceptions like the one in the call trace below in tmc_read_prepare_etb(). This can happen if the user tries to read the TMC etf data via device node without setting up source and the sink first. Fix this by having a check for coresight sysfs mode before reading TMC mode management register. Kernel panic - not syncing: Asynchronous SError Interrupt CPU: 7 PID: 2605 Comm: hexdump Tainted: G S 5.4.30 #122 Call trace: dump_backtrace+0x0/0x188 show_stack+0x20/0x2c dump_stack+0xdc/0x144 panic+0x168/0x36c panic+0x0/0x36c arm64_serror_panic+0x78/0x84 do_serror+0x130/0x138 el1_error+0x84/0xf8 tmc_read_prepare_etb+0x88/0xb8 tmc_open+0x40/0xd8 misc_open+0x120/0x158 chrdev_open+0xb8/0x1a4 do_dentry_open+0x268/0x3a0 vfs_open+0x34/0x40 path_openat+0x39c/0xdf4 do_filp_open+0x90/0x10c do_sys_open+0x150/0x3e8 __arm64_compat_sys_openat+0x28/0x34 el0_svc_common+0xa8/0x160 el0_svc_compat_handler+0x2c/0x38 el0_svc_compat+0x8/0x10 Fixes: 4525412a ("coresight: tmc: making prepare/unprepare functions generic") Reported-by:
-
Suzuki K Poulose authored
On some systems the firmware may not describe all the ports connected to a component (e.g, for security reasons). This could be especially problematic for "funnels" where we could end up in modifying memory beyond the allocated space for refcounts. e.g, for a funnel with input ports listed 0, 3, 5, nr_inport = 3. However the we could access refcnts[5] while checking for references, like : [ 526.110401] ================================================================== [ 526.117988] BUG: KASAN: slab-out-of-bounds in funnel_enable+0x54/0x1b0 [ 526.124706] Read of size 4 at addr ffffff8135f9549c by task bash/1114 [ 526.131324] [ 526.132886] CPU: 3 PID: 1114 Comm: bash Tainted: G S 5.4.25 #232 [ 526.140397] Hardware name: Qualcomm Technologies, Inc. SC7180 IDP (DT) [ 526.147113] Call trace: [ 526.149653] dump_backtrace+0x0/0x188 [ 526.153431] show_stack+0x20/0x2c [ 526.156852] dump_stack+0xdc/0x144 [ 526.160370] print_address_description+0x3c/0x494 [ 526.165211] __kasan_report+0x144/0x168 [ 526.169170] kasan_report+0x10/0x18 [ 526.172769] check_memory_region+0x1a4/0x1b4 [ 526.177164] __kasan_check_read+0x18/0x24 [ 526.181292] funnel_enable+0x54/0x1b0 [ 526.185072] coresight_enable_path+0x104/0x198 [ 526.189649] coresight_enable+0x118/0x26c ... [ 526.237782] Allocated by task 280: [ 526.241298] __kasan_kmalloc+0xf0/0x1ac [ 526.245249] kasan_kmalloc+0xc/0x14 [ 526.248849] __kmalloc+0x28c/0x3b4 [ 526.252361] coresight_register+0x88/0x250 [ 526.256587] funnel_probe+0x15c/0x228 [ 526.260365] dynamic_funnel_probe+0x20/0x2c [ 526.264679] amba_probe+0xbc/0x158 [ 526.268193] really_probe+0x144/0x408 [ 526.271970] driver_probe_device+0x70/0x140 ... [ 526.316810] [ 526.318364] Freed by task 0: [ 526.321344] (stack is not available) [ 526.325024] [ 526.326580] The buggy address belongs to the object at ffffff8135f95480 [ 526.326580] which belongs to the cache kmalloc-128 of size 128 [ 526.339439] The buggy address is located 28 bytes inside of [ 526.339439] 128-byte region [ffffff8135f95480, ffffff8135f95500) [ 526.351399] The buggy address belongs to the page: [ 526.356342] page:ffffffff04b7e500 refcount:1 mapcount:0 mapping:ffffff814b00c380 index:0x0 compound_mapcount: 0 [ 526.366711] flags: 0x4000000000010200(slab|head) [ 526.371475] raw: 4000000000010200 ffffffff05034008 ffffffff0501eb08 ffffff814b00c380 [ 526.379435] raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000 [ 526.387393] page dumped because: kasan: bad access detected [ 526.393128] [ 526.394681] Memory state around the buggy address: [ 526.399619] ffffff8135f95380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 526.407046] ffffff8135f95400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 526.414473] >ffffff8135f95480: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 526.421900] ^ [ 526.426029] ffffff8135f95500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 526.433456] ffffff8135f95580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 526.440883] ================================================================== To keep the code simple, we now track the maximum number of possible input/output connections to/from this component @ nr_inport and nr_outport in platform_data, respectively. Thus the output connections could be sparse and code is adjusted to skip the unspecified connections. Cc: Mathieu Poirier <mathieu.poirier@linaro.org> Cc: Mike Leach <mike.leach@linaro.org> Reported-by:
-
