linux-stable.git/drivers/soc/qcom, branch v5.0.7

soc: qcom: gsbi: Fix error handling in gsbi_probe()

2019-04-05T20:34:44+00:00

[ Upstream commit 8cd09a3dd3e176c62da67efcd477a44a8d87185e ]

If of_platform_populate() fails in gsbi_probe(),
gsbi->hclk is left undisabled.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Andy Gross 
Signed-off-by: Sasha Levin

soc: qcom: rpmh: Avoid accessing freed memory from batch API

2019-03-23T19:11:23+00:00

commit baef1c90aac7e5bf13f0360a3b334825a23d31a1 upstream.

Using the batch API from the interconnect driver sometimes leads to a
KASAN error due to an access to freed memory. This is easier to trigger
with threadirqs on the kernel commandline.

 BUG: KASAN: use-after-free in rpmh_tx_done+0x114/0x12c
 Read of size 1 at addr fffffff51414ad84 by task irq/110-apps_rs/57

 CPU: 0 PID: 57 Comm: irq/110-apps_rs Tainted: G        W         4.19.10 #72
 Call trace:
  dump_backtrace+0x0/0x2f8
  show_stack+0x20/0x2c
  __dump_stack+0x20/0x28
  dump_stack+0xcc/0x10c
  print_address_description+0x74/0x240
  kasan_report+0x250/0x26c
  __asan_report_load1_noabort+0x20/0x2c
  rpmh_tx_done+0x114/0x12c
  tcs_tx_done+0x450/0x768
  irq_forced_thread_fn+0x58/0x9c
  irq_thread+0x120/0x1dc
  kthread+0x248/0x260
  ret_from_fork+0x10/0x18

 Allocated by task 385:
  kasan_kmalloc+0xac/0x148
  __kmalloc+0x170/0x1e4
  rpmh_write_batch+0x174/0x540
  qcom_icc_set+0x8dc/0x9ac
  icc_set+0x288/0x2e8
  a6xx_gmu_stop+0x320/0x3c0
  a6xx_pm_suspend+0x108/0x124
  adreno_suspend+0x50/0x60
  pm_generic_runtime_suspend+0x60/0x78
  __rpm_callback+0x214/0x32c
  rpm_callback+0x54/0x184
  rpm_suspend+0x3f8/0xa90
  pm_runtime_work+0xb4/0x178
  process_one_work+0x544/0xbc0
  worker_thread+0x514/0x7d0
  kthread+0x248/0x260
  ret_from_fork+0x10/0x18

 Freed by task 385:
  __kasan_slab_free+0x12c/0x1e0
  kasan_slab_free+0x10/0x1c
  kfree+0x134/0x588
  rpmh_write_batch+0x49c/0x540
  qcom_icc_set+0x8dc/0x9ac
  icc_set+0x288/0x2e8
  a6xx_gmu_stop+0x320/0x3c0
  a6xx_pm_suspend+0x108/0x124
  adreno_suspend+0x50/0x60
 cr50_spi spi5.0: SPI transfer timed out
  pm_generic_runtime_suspend+0x60/0x78
  __rpm_callback+0x214/0x32c
  rpm_callback+0x54/0x184
  rpm_suspend+0x3f8/0xa90
  pm_runtime_work+0xb4/0x178
  process_one_work+0x544/0xbc0
  worker_thread+0x514/0x7d0
  kthread+0x248/0x260
  ret_from_fork+0x10/0x18

 The buggy address belongs to the object at fffffff51414ac80
  which belongs to the cache kmalloc-512 of size 512
 The buggy address is located 260 bytes inside of
  512-byte region [fffffff51414ac80, fffffff51414ae80)
 The buggy address belongs to the page:
 page:ffffffbfd4505200 count:1 mapcount:0 mapping:fffffff51e00c680 index:0x0 compound_mapcount: 0
 flags: 0x4000000000008100(slab|head)
 raw: 4000000000008100 ffffffbfd4529008 ffffffbfd44f9208 fffffff51e00c680
 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  fffffff51414ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  fffffff51414ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 >fffffff51414ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                    ^
  fffffff51414ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  fffffff51414ae80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

The batch API sets the same completion for each rpmh message that's sent
and then loops through all the messages and waits for that single
completion declared on the stack to be completed before returning from
the function and freeing the message structures. Unfortunately, some
messages may still be in process and 'stuck' in the TCS. At some later
point, the tcs_tx_done() interrupt will run and try to process messages
that have already been freed at the end of rpmh_write_batch(). This will
in turn access the 'needs_free' member of the rpmh_request structure and
cause KASAN to complain. Furthermore, if there's a message that's
completed in rpmh_tx_done() and freed immediately after the complete()
call is made we'll be racing with potentially freed memory when
accessing the 'needs_free' member:

	CPU0                         CPU1
	----                         ----
	rpmh_tx_done()
	 complete(&compl)
	                             wait_for_completion(&compl)
	                             kfree(rpm_msg)
	 if (rpm_msg->needs_free)
	 

Let's fix this by allocating a chunk of completions for each message and
waiting for all of them to be completed before returning from the batch
API. Alternatively, we could wait for the last message in the batch, but
that may be a more complicated change because it looks like
tcs_tx_done() just iterates through the indices of the queue and
completes each message instead of tracking the last inserted message and
completing that first.

Fixes: c8790cb6da58 ("drivers: qcom: rpmh: add support for batch RPMH request")
Cc: Lina Iyer 
Cc: "Raju P.L.S.S.S.N" 
Cc: Matthias Kaehlcke 
Cc: Evan Green 
Cc: stable@vger.kernel.org
Reviewed-by: Lina Iyer 
Reviewed-by: Evan Green 
Signed-off-by: Stephen Boyd 
Signed-off-by: Bjorn Andersson 
Signed-off-by: Andy Gross 
Signed-off-by: Greg Kroah-Hartman

soc: qcom: smd-rpm: Add QCS404 compatible

2018-11-29T06:01:11+00:00

This patch adds a compatible for the rpm on the Qualcomm QCS404 platform.

Signed-off-by: Bjorn Andersson 
Reviewed-by: Vinod Koul 
Signed-off-by: Andy Gross

soc: qcom: llcc-slice: Remove duplicated include from llcc-slice.c

2018-11-28T23:37:20+00:00

Remove duplicated include.

Signed-off-by: YueHaibing 
Signed-off-by: Andy Gross

soc: qcom: cmd-db: Stop memcpy()ing in cmd_db_read_aux_data()

2018-11-14T18:06:24+00:00

Let's change the function signature to return the pointer to memory or
an error pointer on failure, and take an argument that lets us return
the size of the aux data read. This way we can remove the
cmd_db_read_aux_data_len() API entirely and also get rid of the memcpy
operation from cmd_db to the caller. Updating the only user of this code
shows that making this change allows us to remove a function and put the
lookup where the user is.

Cc: Mahesh Sivasubramanian 
Cc: Lina Iyer 
Cc: Bjorn Andersson 
Cc: Evan Green 
Cc: Jordan Crouse 
Cc: Rob Clark 
Signed-off-by: Stephen Boyd 
Signed-off-by: Andy Gross

soc: qcom: cmd-db: Remove memcpy()ing from cmd_db_get_header()

2018-11-14T18:05:50+00:00

The cmd_db_get_header() function is a static local function that doesn't
need to copy anything from one place to another. Instead, it can just
point into the region by returning pointers to what we're looking for.
If we do that, we should mark what we're returning as const so that code
can't modify cmd-db without an obvious cast.

Cc: Mahesh Sivasubramanian 
Cc: Lina Iyer 
Cc: Bjorn Andersson 
Cc: Evan Green 
Signed-off-by: Stephen Boyd 
Signed-off-by: Andy Gross

soc: qcom: Drop help text for QCOM_QMI_HELPERS

2018-11-14T18:03:36+00:00

The help text is visible in menuconfig, however QCOM_QMI_HELPERS is a
hidden kconfig, so it is not selectable in menuconfig.

Remove the help text so that it is more clear that this is intentionally
a hidden kconfig.

Signed-off-by: Niklas Cassel 
Reviewed-by: Alex Elder 
Reviewed-by: Bjorn Andersson 
Signed-off-by: Andy Gross

soc: qcom: qmi_interface: Limit txn ids to U16_MAX

2018-11-14T18:02:07+00:00

Txn IDs created up to INT_MAX cause overflow while storing
the IDs in u16 type supported by QMI header.

Limit the txn IDs max value to U16_MAX to avoid overflow.

Signed-off-by: Arun Kumar Neelakantam 
Reviewed-by: Bjorn Andersson 
Signed-off-by: Andy Gross

soc: qcom: llcc-slice: Add error checks for API functions

2018-11-14T17:59:03+00:00

llcc_slice_getd can return a ERR_PTR code on failure. Add a IS_ERR_OR_NULL
check to subsequent API calls that use struct llcc_slice_desc to guard
against faults and to let the leaf drivers get away with safely using a
ERR_PTR() encoded "pointer" in the aftermath of a llcc_slice_getd error.

Signed-off-by: Jordan Crouse 
Reviewed-by: Vivek Gautam 
Signed-off-by: Andy Gross

soc: qcom/llcc: add MODULE_LICENSE tag

2018-11-14T17:56:36+00:00

The lack of a MODULE_LICENSE tag prevents building the llcc driver
as a loadable module:

FATAL: modpost: GPL-incompatible module llcc-slice.ko uses GPL-only symbol 'ktime_get'

This adds the appropriate license and description tags.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Andy Gross