In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained in a ccu_common struct. This assumption is incorrect and, in consequence, causes invalid pointer de-references.
Remove the faulty call. Instead, add one more loop that iterates over the ccu_clks and sets the rate range, if required.
Fixes: b914ec33b391 ("clk: sunxi-ng: common: Support minimum and maximum rate") Reported-by: Robert J. Pafford pafford.9@buckeyemail.osu.edu Closes: https://lore.kernel.org/lkml/DM6PR01MB58047C810DDD5D0AE397CADFF7C22@DM6PR01M... Cc: stable@vger.kernel.org Signed-off-by: Frank Oltmanns frank@oltmanns.dev --- Robert, could you please test if this fixes the issue you reported.
I'm CC'ing Måns here, because he observed some strange behavior [1] with the original patch. Is it possible for you to look into if this patch fixes your issue without the need for the following (seemingly unrelated) patches: cedb7dd193f6 "drm/sun4i: hdmi: Convert encoder to atomic" 9ca6bc246035 "drm/sun4i: hdmi: Move mode_set into enable"
Thanks, Frank
[1]: https://lore.kernel.org/lkml/yw1xo78z8ez0.fsf@mansr.com/ --- drivers/clk/sunxi-ng/ccu_common.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c index ac0091b4ce24..be375ce0149c 100644 --- a/drivers/clk/sunxi-ng/ccu_common.c +++ b/drivers/clk/sunxi-ng/ccu_common.c @@ -132,7 +132,6 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
for (i = 0; i < desc->hw_clks->num ; i++) { struct clk_hw *hw = desc->hw_clks->hws[i]; - struct ccu_common *common = hw_to_ccu_common(hw); const char *name;
if (!hw) @@ -147,14 +146,21 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, pr_err("Couldn't register clock %d - %s\n", i, name); goto err_clk_unreg; } + } + + for (i = 0; i < desc->num_ccu_clks; i++) { + struct ccu_common *cclk = desc->ccu_clks[i]; + + if (!cclk) + continue;
- if (common->max_rate) - clk_hw_set_rate_range(hw, common->min_rate, - common->max_rate); + if (cclk->max_rate) + clk_hw_set_rate_range(&cclk->hw, cclk->min_rate, + cclk->max_rate); else - WARN(common->min_rate, + WARN(cclk->min_rate, "No max_rate, ignoring min_rate of clock %d - %s\n", - i, name); + i, clk_hw_get_name(&cclk->hw)); }
ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
--- base-commit: 2607133196c35f31892ee199ce7ffa717bea4ad1 change-id: 20240622-sunxi-ng_fix_common_probe-5677c3e487fc
Best regards,
Frank Oltmanns frank@oltmanns.dev writes:
In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained in a ccu_common struct. This assumption is incorrect and, in consequence, causes invalid pointer de-references.
Remove the faulty call. Instead, add one more loop that iterates over the ccu_clks and sets the rate range, if required.
Fixes: b914ec33b391 ("clk: sunxi-ng: common: Support minimum and maximum rate") Reported-by: Robert J. Pafford pafford.9@buckeyemail.osu.edu Closes: https://lore.kernel.org/lkml/DM6PR01MB58047C810DDD5D0AE397CADFF7C22@DM6PR01M... Cc: stable@vger.kernel.org Signed-off-by: Frank Oltmanns frank@oltmanns.dev
Robert, could you please test if this fixes the issue you reported.
I'm CC'ing Måns here, because he observed some strange behavior [1] with the original patch. Is it possible for you to look into if this patch fixes your issue without the need for the following (seemingly unrelated) patches: cedb7dd193f6 "drm/sun4i: hdmi: Convert encoder to atomic" 9ca6bc246035 "drm/sun4i: hdmi: Move mode_set into enable"
This does indeed fix it. 6.9 is still broken, though, but that's probably for other reasons.
Thanks, Frank
[1]: https://lore.kernel.org/lkml/yw1xo78z8ez0.fsf@mansr.com/
drivers/clk/sunxi-ng/ccu_common.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c index ac0091b4ce24..be375ce0149c 100644 --- a/drivers/clk/sunxi-ng/ccu_common.c +++ b/drivers/clk/sunxi-ng/ccu_common.c @@ -132,7 +132,6 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
for (i = 0; i < desc->hw_clks->num ; i++) { struct clk_hw *hw = desc->hw_clks->hws[i];
struct ccu_common *common = hw_to_ccu_common(hw);const char *name;
if (!hw)
@@ -147,14 +146,21 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, pr_err("Couldn't register clock %d - %s\n", i, name); goto err_clk_unreg; }
- }
- for (i = 0; i < desc->num_ccu_clks; i++) {
struct ccu_common *cclk = desc->ccu_clks[i];if (!cclk)continue;
if (common->max_rate)clk_hw_set_rate_range(hw, common->min_rate,common->max_rate);
if (cclk->max_rate)clk_hw_set_rate_range(&cclk->hw, cclk->min_rate,cclk->max_rate);
WARN(common->min_rate,
WARN(cclk->min_rate, "No max_rate, ignoring min_rate of clock %d - %s\n",
i, name);
i, clk_hw_get_name(&cclk->hw));}
ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
base-commit: 2607133196c35f31892ee199ce7ffa717bea4ad1 change-id: 20240622-sunxi-ng_fix_common_probe-5677c3e487fc
Best regards,
Frank Oltmanns frank@oltmanns.dev
On Thu, Jun 27, 2024 at 7:39 PM Måns Rullgård mans@mansr.com wrote:
Frank Oltmanns frank@oltmanns.dev writes:
In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained in a ccu_common struct. This assumption is incorrect and, in consequence, causes invalid pointer de-references.
Remove the faulty call. Instead, add one more loop that iterates over the ccu_clks and sets the rate range, if required.
Fixes: b914ec33b391 ("clk: sunxi-ng: common: Support minimum and maximum rate") Reported-by: Robert J. Pafford pafford.9@buckeyemail.osu.edu Closes: https://lore.kernel.org/lkml/DM6PR01MB58047C810DDD5D0AE397CADFF7C22@DM6PR01M... Cc: stable@vger.kernel.org Signed-off-by: Frank Oltmanns frank@oltmanns.dev
Robert, could you please test if this fixes the issue you reported.
I'm CC'ing Måns here, because he observed some strange behavior [1] with the original patch. Is it possible for you to look into if this patch fixes your issue without the need for the following (seemingly unrelated) patches: cedb7dd193f6 "drm/sun4i: hdmi: Convert encoder to atomic" 9ca6bc246035 "drm/sun4i: hdmi: Move mode_set into enable"
This does indeed fix it. 6.9 is still broken, though, but that's probably for other reasons.
Can I take that as a Tested-by?
Thanks, Frank
[1]: https://lore.kernel.org/lkml/yw1xo78z8ez0.fsf@mansr.com/
drivers/clk/sunxi-ng/ccu_common.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c index ac0091b4ce24..be375ce0149c 100644 --- a/drivers/clk/sunxi-ng/ccu_common.c +++ b/drivers/clk/sunxi-ng/ccu_common.c @@ -132,7 +132,6 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
for (i = 0; i < desc->hw_clks->num ; i++) { struct clk_hw *hw = desc->hw_clks->hws[i];
struct ccu_common *common = hw_to_ccu_common(hw); const char *name; if (!hw)@@ -147,14 +146,21 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, pr_err("Couldn't register clock %d - %s\n", i, name); goto err_clk_unreg; }
}for (i = 0; i < desc->num_ccu_clks; i++) {struct ccu_common *cclk = desc->ccu_clks[i];if (!cclk)continue;
if (common->max_rate)clk_hw_set_rate_range(hw, common->min_rate,common->max_rate);
if (cclk->max_rate)clk_hw_set_rate_range(&cclk->hw, cclk->min_rate,cclk->max_rate); else
WARN(common->min_rate,
WARN(cclk->min_rate, "No max_rate, ignoring min_rate of clock %d - %s\n",
i, name);
i, clk_hw_get_name(&cclk->hw)); } ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
base-commit: 2607133196c35f31892ee199ce7ffa717bea4ad1 change-id: 20240622-sunxi-ng_fix_common_probe-5677c3e487fc
Best regards,
Frank Oltmanns frank@oltmanns.dev
-- Måns Rullgård
Frank Oltmanns frank@oltmanns.dev writes:
In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained in a ccu_common struct. This assumption is incorrect and, in consequence, causes invalid pointer de-references.
Remove the faulty call. Instead, add one more loop that iterates over the ccu_clks and sets the rate range, if required.
Fixes: b914ec33b391 ("clk: sunxi-ng: common: Support minimum and maximum rate") Reported-by: Robert J. Pafford pafford.9@buckeyemail.osu.edu Closes: https://lore.kernel.org/lkml/DM6PR01MB58047C810DDD5D0AE397CADFF7C22@DM6PR01M... Cc: stable@vger.kernel.org Signed-off-by: Frank Oltmanns frank@oltmanns.dev
Tested-by: Robert J. Pafford pafford.9@buckeyemail.osu.edu
Robert, could you please test if this fixes the issue you reported.
I just applied this patch to my board's kernel, and it fixes the issue.
I'm CC'ing Måns here, because he observed some strange behavior [1] with the original patch. Is it possible for you to look into if this patch fixes your issue without the need for the following (seemingly unrelated) patches: cedb7dd193f6 "drm/sun4i: hdmi: Convert encoder to atomic" 9ca6bc246035 "drm/sun4i: hdmi: Move mode_set into enable" Thanks, Frank
[1]: https://lore.kernel.org/lkml/yw1xo78z8ez0.fsf@mansr.com/
drivers/clk/sunxi-ng/ccu_common.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c index ac0091b4ce24..be375ce0149c 100644 --- a/drivers/clk/sunxi-ng/ccu_common.c +++ b/drivers/clk/sunxi-ng/ccu_common.c @@ -132,7 +132,6 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev,
for (i = 0; i < desc->hw_clks->num ; i++) { struct clk_hw *hw = desc->hw_clks->hws[i];
struct ccu_common *common = hw_to_ccu_common(hw);const char *name;
if (!hw)
@@ -147,14 +146,21 @@ static int sunxi_ccu_probe(struct sunxi_ccu *ccu, struct device *dev, pr_err("Couldn't register clock %d - %s\n", i, name); goto err_clk_unreg; }
- }
- for (i = 0; i < desc->num_ccu_clks; i++) {
struct ccu_common *cclk = desc->ccu_clks[i];if (!cclk)continue;
if (common->max_rate)clk_hw_set_rate_range(hw, common->min_rate,common->max_rate);
if (cclk->max_rate)clk_hw_set_rate_range(&cclk->hw, cclk->min_rate,cclk->max_rate);
WARN(common->min_rate,
WARN(cclk->min_rate, "No max_rate, ignoring min_rate of clock %d - %s\n",
i, name);
i, clk_hw_get_name(&cclk->hw));}
ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get,
base-commit: 2607133196c35f31892ee199ce7ffa717bea4ad1 change-id: 20240622-sunxi-ng_fix_common_probe-5677c3e487fc
Best regards,
Frank Oltmanns frank@oltmanns.dev
Thank you, Robert Pafford pafford.9@buckeyemail.osu.edu
From: Chen-Yu Tsai wens@csie.org
On Sun, 23 Jun 2024 10:45:58 +0200, Frank Oltmanns wrote:
In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained in a ccu_common struct. This assumption is incorrect and, in consequence, causes invalid pointer de-references.
Remove the faulty call. Instead, add one more loop that iterates over the ccu_clks and sets the rate range, if required.
[...]
Applied to clk-fixes-for-6.10 in git@github.com:linux-sunxi/linux-sunxi.git, thanks!
[1/1] clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common commit: ea977d742507e534d9fe4f4d74256f6b7f589338
Best regards,
linux-stable-mirror@lists.linaro.org
-
Chen-Yu Tsai -
Chen-Yu Tsai -
Frank Oltmanns -
Måns Rullgård -
Pafford, Robert J.