releases/4.14.53/of-platform-stop-accessing-invalid-dev-in-of_platform_device_destroy.patch

   1 From 522811e944ed9b36806faa019faec10f9d259cca Mon Sep 17 00:00:00 2001
   2 From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
   3 Date: Mon, 4 Jun 2018 15:14:08 +0100
   4 Subject: of: platform: stop accessing invalid dev in of_platform_device_destroy
   5
   6 From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
   7
   8 commit 522811e944ed9b36806faa019faec10f9d259cca upstream.
   9
  10 Immediately after the platform_device_unregister() the device will be
  11 cleaned up. Accessing the freed pointer immediately after that will
  12 crash the system.
  13
  14 Found this bug when kernel is built with CONFIG_PAGE_POISONING and testing
  15 loading/unloading audio drivers in a loop on Qcom platforms.
  16
  17 Fix this by moving of_node_clear_flag() just before the unregister calls.
  18
  19 Below is the crash trace:
  20
  21 Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c03
  22 Mem abort info:
  23   ESR = 0x96000021
  24   Exception class = DABT (current EL), IL = 32 bits
  25   SET = 0, FnV = 0
  26   EA = 0, S1PTW = 0
  27 Data abort info:
  28   ISV = 0, ISS = 0x00000021
  29   CM = 0, WnR = 0
  30 [006b6b6b6b6b6c03] address between user and kernel address ranges
  31 Internal error: Oops: 96000021 [#1] PREEMPT SMP
  32 Modules linked in:
  33 CPU: 2 PID: 1784 Comm: sh Tainted: G        W         4.17.0-rc7-02230-ge3a63a7ef641-dirty #204
  34 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
  35 pstate: 80000005 (Nzcv daif -PAN -UAO)
  36 pc : clear_bit+0x18/0x2c
  37 lr : of_platform_device_destroy+0x64/0xb8
  38 sp : ffff00000c9c3930
  39 x29: ffff00000c9c3930 x28: ffff80003d39b200
  40 x27: ffff000008bb1000 x26: 0000000000000040
  41 x25: 0000000000000124 x24: ffff80003a9a3080
  42 x23: 0000000000000060 x22: ffff00000939f518
  43 x21: ffff80003aa79e98 x20: ffff80003aa3dae0
  44 x19: ffff80003aa3c890 x18: ffff800009feb794
  45 x17: 0000000000000000 x16: 0000000000000000
  46 x15: ffff800009feb790 x14: 0000000000000000
  47 x13: ffff80003a058778 x12: ffff80003a058728
  48 x11: ffff80003a058750 x10: 0000000000000000
  49 x9 : 0000000000000006 x8 : ffff80003a825988
  50 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000001
  51 x5 : 0000000000000000 x4 : 0000000000000001
  52 x3 : 0000000000000008 x2 : 0000000000000001
  53 x1 : 6b6b6b6b6b6b6c03 x0 : 0000000000000000
  54 Process sh (pid: 1784, stack limit = 0x        (ptrval))
  55 Call trace:
  56  clear_bit+0x18/0x2c
  57  q6afe_remove+0x20/0x38
  58  apr_device_remove+0x30/0x70
  59  device_release_driver_internal+0x170/0x208
  60  device_release_driver+0x14/0x20
  61  bus_remove_device+0xcc/0x150
  62  device_del+0x10c/0x310
  63  device_unregister+0x1c/0x70
  64  apr_remove_device+0xc/0x18
  65  device_for_each_child+0x50/0x80
  66  apr_remove+0x18/0x20
  67  rpmsg_dev_remove+0x38/0x68
  68  device_release_driver_internal+0x170/0x208
  69  device_release_driver+0x14/0x20
  70  bus_remove_device+0xcc/0x150
  71  device_del+0x10c/0x310
  72  device_unregister+0x1c/0x70
  73  qcom_smd_remove_device+0xc/0x18
  74  device_for_each_child+0x50/0x80
  75  qcom_smd_unregister_edge+0x3c/0x70
  76  smd_subdev_remove+0x18/0x28
  77  rproc_stop+0x48/0xd8
  78  rproc_shutdown+0x60/0xe8
  79  state_store+0xbc/0xf8
  80  dev_attr_store+0x18/0x28
  81  sysfs_kf_write+0x3c/0x50
  82  kernfs_fop_write+0x118/0x1e0
  83  __vfs_write+0x18/0x110
  84  vfs_write+0xa4/0x1a8
  85  ksys_write+0x48/0xb0
  86  sys_write+0xc/0x18
  87  el0_svc_naked+0x30/0x34
  88 Code: d2800022 8b400c21 f9800031 9ac32043 (c85f7c22)
  89 ---[ end trace 32020935775616a2 ]---
  90
  91 Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
  92 Cc: stable@vger.kernel.org
  93 Signed-off-by: Rob Herring <robh@kernel.org>
  94 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  95
  96 ---
  97  drivers/of/platform.c |    5 +++--
  98  1 file changed, 3 insertions(+), 2 deletions(-)
  99
 100 --- a/drivers/of/platform.c
 101 +++ b/drivers/of/platform.c
 102 @@ -533,6 +533,9 @@ int of_platform_device_destroy(struct de
 103         if (of_node_check_flag(dev->of_node, OF_POPULATED_BUS))
 104                 device_for_each_child(dev, NULL, of_platform_device_destroy);
 105
 106 +       of_node_clear_flag(dev->of_node, OF_POPULATED);
 107 +       of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
 108 +
 109         if (dev->bus == &platform_bus_type)
 110                 platform_device_unregister(to_platform_device(dev));
 111  #ifdef CONFIG_ARM_AMBA
 112 @@ -540,8 +543,6 @@ int of_platform_device_destroy(struct de
 113                 amba_device_unregister(to_amba_device(dev));
 114  #endif
 115
 116 -       of_node_clear_flag(dev->of_node, OF_POPULATED);
 117 -       of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
 118         return 0;
 119  }
 120  EXPORT_SYMBOL_GPL(of_platform_device_destroy);