From patchwork Thu Apr 26 11:55:34 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Niklas Cassel X-Patchwork-Id: 134512 Delivered-To: patch@linaro.org Received: by 10.46.151.6 with SMTP id r6csp2186815lji; Thu, 26 Apr 2018 04:55:54 -0700 (PDT) X-Google-Smtp-Source: AIpwx49fs1GuYvSrX7Mabu/+tcunFv3qE9mQUxpfr2xsHWqHH7LNk1RyRAfQMDbSpXtxPimDA+oq X-Received: by 2002:a17:902:8f96:: with SMTP id z22-v6mr33233335plo.200.1524743754478; Thu, 26 Apr 2018 04:55:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524743754; cv=none; d=google.com; s=arc-20160816; b=mElZcAB47amp8uFKM9BpBtjkbBkFi/Wt3yrMwT2VYdGpXTKrKFnly4jlQ24ZOzYCGu wnssLKmU3yzbR1UDDstBhYOft4dfn4XoMhJqSC9uocw1jSxlcDOVPgPVM8uWqzAHrKtg yM8GFtE7fVSOPwFGnpDGO/onW+oSstLIQZrdRyV6m212GPGhfuBGjy+y9g9ecNUdxujJ 3ZcXlAHGWIxv0knQH9tQ9i33+k8Db73UUOsYdexljPOgoPVmHWTkb1u03WM/vSj5ryvA o4tY3DYp1nzaZyEpWk2Hnz8OBQG+slRdkUoVn7sq4BgiIwC5Rd3ET89VXvdZxRkqmAsS mJqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :dkim-signature:arc-authentication-results; bh=IxJbzDMn9YLUt6vv54dFL6EbmRYsIGz0vnOlvcofvAc=; b=yqzgTDFgurVbAbUhcjDOBeIYW+0XWBmwbRdylf3cVdsjgfChq9jsHg+4bt7EEQ7j9M WH7hh1l48GHVLmvJaGbprEoOpJVT77+eGBLeAjVMPGG7bzNKSWP8dJVDMlBk8+tLy3RX eE+yqICRLNzJZ3MPywVcfTWdAIlSeYmrx+fCJ90XprqdnOkF7X9UBLujP3ceTnkxBoDZ Ge0xEgQU3Ggfl9tBl7AxLf1QcXTCbr/jlDL6GGKi2jgfVputR0TruIz6x+SD1EQpitr4 SXf7uDRcQ7uQs16JFS9e0Yah3jkVg8TTaQwcaExZIpoRfiQ68NCojjmLyalbH5c8agLw oR3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=gDCdmLVV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o4si15171340pgd.125.2018.04.26.04.55.54; Thu, 26 Apr 2018 04:55:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=gDCdmLVV; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756202AbeDZLzw (ORCPT + 29 others); Thu, 26 Apr 2018 07:55:52 -0400 Received: from mail-lf0-f68.google.com ([209.85.215.68]:41266 "EHLO mail-lf0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756335AbeDZLzq (ORCPT ); Thu, 26 Apr 2018 07:55:46 -0400 Received: by mail-lf0-f68.google.com with SMTP id o123-v6so27716475lfe.8 for ; Thu, 26 Apr 2018 04:55:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=IxJbzDMn9YLUt6vv54dFL6EbmRYsIGz0vnOlvcofvAc=; b=gDCdmLVV3Unl4VMJ1RY/A6AMumzHTB/SLbGsQyfz9/g+cWUPZlAbeZ6Rh5OM/gUVTI /4ZwaqsZWLwIGzx4EuZe09RbpEML/mzqofwUoPI/tw+XfzbVAi878vfdJB7h/JcsBKjJ KoY97XQi11Qj1HbE/x58pbmwKaYO8meev5+Sk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=IxJbzDMn9YLUt6vv54dFL6EbmRYsIGz0vnOlvcofvAc=; b=CrfeuoHvTj81H8nC9IAzPLnWk3AkMo/6hIA0yFtVGsdLGLjRr8PhuKBNPLvnm8XBAj QgSH/EhL3VxvZevk9xpfDLLWEvyAJRYku7D5sQB3C6fcOS1NgbYnRwOwc6fk7mhFYQZS a/ESWvrxIQHCnfb7RsQRqff2KBZbCMVNRLnGCBfbSobtKc0KOyGNRAHJVmbnl7s2rw6+ sPJ3xp4BEIeh6sRDKWOqYsXrbyLGfeiWMfMrtzJI0onKbEvD/O7gGHaXAURgq5cLAH4z XPVX7Rmd02d6nEPlLrmZeKnGCMCl0d4LM549HlwjXRy5bFkfKS/D6R6G/2i9zoc81Zw8 Iakw== X-Gm-Message-State: ALQs6tB1q5+V17j74YRz5Caz68S/vr0c8Vl8vpch8IctWiAfvIFSzmbG B/yf9qEQRvjWc8jleI+PPLB+tw== X-Received: by 10.46.156.8 with SMTP id s8mr8633410lji.97.1524743744180; Thu, 26 Apr 2018 04:55:44 -0700 (PDT) Received: from localhost.localdomain (h-184-10.A323.priv.bahnhof.se. [155.4.184.10]) by smtp.gmail.com with ESMTPSA id e23-v6sm4391603lfi.58.2018.04.26.04.55.42 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 26 Apr 2018 04:55:43 -0700 (PDT) From: Niklas Cassel To: andy.gross@linaro.org, david.brown@linaro.org Cc: bjorn.andersson@linaro.org, sboyd@kernel.org, linux-arm-msm@vger.kernel.org, linux-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Niklas Cassel Subject: [PATCH RESEND] firmware: qcom: scm: Fix crash in qcom_scm_call_atomic1() Date: Thu, 26 Apr 2018 13:55:34 +0200 Message-Id: <20180426115534.20971-1-niklas.cassel@linaro.org> X-Mailer: git-send-email 2.14.3 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org qcom_scm_call_atomic1() can crash with a NULL pointer dereference at qcom_scm_call_atomic1+0x30/0x48. disassembly of qcom_scm_call_atomic1(): ... <0xc08d73b0 <+12>: ldr r3, [r12] ... (no instruction explicitly modifies r12) 0xc08d73cc <+40>: smc 0 ... (no instruction explicitly modifies r12) 0xc08d73d4 <+48>: ldr r3, [r12] <- crashing instruction ... Since the first ldr is successful, and since r12 isn't explicitly modified by any instruction between the first and the second ldr, it must have been modified by the smc call, which is ok, since r12 is caller save according to the AAPCS. Add r12 to the clobber list so that the compiler knows that the callee potentially overwrites the value in r12. Clobber descriptions may not in any way overlap with an input or output operand. Reviewed-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Niklas Cassel --- drivers/firmware/qcom_scm-32.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.14.3 diff --git a/drivers/firmware/qcom_scm-32.c b/drivers/firmware/qcom_scm-32.c index dfbd894d5bb7..4e24e591ae74 100644 --- a/drivers/firmware/qcom_scm-32.c +++ b/drivers/firmware/qcom_scm-32.c @@ -147,7 +147,7 @@ static u32 smc(u32 cmd_addr) "smc #0 @ switch to secure world\n" : "=r" (r0) : "r" (r0), "r" (r1), "r" (r2) - : "r3"); + : "r3", "r12"); } while (r0 == QCOM_SCM_INTERRUPTED); return r0; @@ -263,7 +263,7 @@ static s32 qcom_scm_call_atomic1(u32 svc, u32 cmd, u32 arg1) "smc #0 @ switch to secure world\n" : "=r" (r0) : "r" (r0), "r" (r1), "r" (r2) - : "r3"); + : "r3", "r12"); return r0; } @@ -298,7 +298,7 @@ static s32 qcom_scm_call_atomic2(u32 svc, u32 cmd, u32 arg1, u32 arg2) "smc #0 @ switch to secure world\n" : "=r" (r0) : "r" (r0), "r" (r1), "r" (r2), "r" (r3) - ); + : "r12"); return r0; } @@ -328,7 +328,7 @@ u32 qcom_scm_get_version(void) "smc #0 @ switch to secure world\n" : "=r" (r0), "=r" (r1) : "r" (r0), "r" (r1) - : "r2", "r3"); + : "r2", "r3", "r12"); } while (r0 == QCOM_SCM_INTERRUPTED); version = r1;