mirror of
https://github.com/torvalds/linux.git
synced 2024-11-23 04:31:50 +00:00
4053caf60b
Florian reported the following kernel NULL pointer dereference issue on
a BCM7250 board:
[ 2.829744] Unable to handle kernel NULL pointer dereference at virtual address 0000000c when read
[ 2.838740] [0000000c] *pgd=80000000004003, *pmd=00000000
[ 2.844178] Internal error: Oops: 206 [#1] SMP ARM
[ 2.848990] Modules linked in:
[ 2.852061] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-next-20240305-gd95fcdf4961d #66
[ 2.860436] Hardware name: Broadcom STB (Flattened Device Tree)
[ 2.866371] PC is at brcmnand_read_by_pio+0x180/0x278
[ 2.871449] LR is at __wait_for_common+0x9c/0x1b0
[ 2.876178] pc : [<c094b6cc>] lr : [<c0e66310>] psr: 60000053
[ 2.882460] sp : f0811a80 ip : 00000012 fp : 00000000
[ 2.887699] r10: 00000000 r9 : 00000000 r8 : c3790000
[ 2.892936] r7 : 00000000 r6 : 00000000 r5 : c35db440 r4 : ffe00000
[ 2.899479] r3 : f15cb814 r2 : 00000000 r1 : 00000000 r0 : 00000000
The issue only happens when dma mode is disabled or not supported on STB
chip. The pio mode transfer calls brcmnand_read_data_bus function which
dereferences ctrl->soc->read_data_bus. But the soc member in STB chip is
NULL hence triggers the access violation. The function needs to check
the soc pointer first.
Fixes:
|
||
|---|---|---|
| .. | ||
| onenand | ||
| raw | ||
| spi | ||
| bbt.c | ||
| core.c | ||
| ecc-mtk.c | ||
| ecc-mxic.c | ||
| ecc-sw-bch.c | ||
| ecc-sw-hamming.c | ||
| ecc.c | ||
| Kconfig | ||
| Makefile | ||