diff options
| author | Jingyi Wang <jingyi.wang@oss.qualcomm.com> | 2026-06-23 02:05:35 -0700 |
|---|---|---|
| committer | Bjorn Andersson <andersson@kernel.org> | 2026-07-15 12:18:05 -0500 |
| commit | f44ae8ce156a387b07d40e2d6a0ef979a2748aa1 (patch) | |
| tree | 61081e799241faf2dc6cb9ce93acbe0f065eec7d /include | |
| parent | 026a3fada43261e403c6c4d9bda9501547e3f108 (diff) | |
| download | linux-f44ae8ce156a387b07d40e2d6a0ef979a2748aa1.tar.gz linux-f44ae8ce156a387b07d40e2d6a0ef979a2748aa1.zip | |
remoteproc: qcom: Check subdev start status in rproc_stop()
For rproc that doing attach, rproc_start_subdevices() is called only when
attach successfully. If rproc_report_crash() is called in the attach
function, rproc_boot_recovery()->rproc_stop()->rproc_stop_subdevices()->
glink_subdev_stop() could be called and cause NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300
Mem abort info:
...
pc : qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem]
lr : glink_subdev_stop+0x1c/0x30 [qcom_common]
...
Call trace:
qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] (P)
glink_subdev_stop+0x1c/0x30 [qcom_common]
rproc_stop+0x58/0x17c
rproc_trigger_recovery+0xb0/0x150
rproc_crash_handler_work+0xa4/0xc4
process_scheduled_works+0x18c/0x2d8
worker_thread+0x144/0x280
kthread+0x124/0x138
ret_from_fork+0x10/0x20
Code: a9be7bfd 910003fd a90153f3 aa0003f3 (b9430000)
---[ end trace 0000000000000000 ]---
Introduce "subdevs_started" flag to indicate rproc_start_subdevices() has
been called successfully. Ensure subdevices are only stopped if they have
been started.
Signed-off-by: Jingyi Wang <jingyi.wang@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623-rproc-attach-issue-v3-2-8e24310707ce@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/remoteproc.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h index f1d14d075bf3..17ed75a11e15 100644 --- a/include/linux/remoteproc.h +++ b/include/linux/remoteproc.h @@ -272,6 +272,7 @@ enum rproc_features { * @has_iommu: flag to indicate if remote processor is behind an MMU * @auto_boot: flag to indicate if remote processor should be auto-started * @sysfs_read_only: flag to make remoteproc sysfs files read only + * @subdevs_started: flag to indicate if subdevs have started * @dump_segments: list of segments in the firmware * @nb_vdev: number of vdev currently handled by rproc * @elf_class: firmware ELF class @@ -314,6 +315,7 @@ struct rproc { bool has_iommu; bool auto_boot; bool sysfs_read_only; + bool subdevs_started; struct list_head dump_segments; int nb_vdev; u8 elf_class; |