Skip to content

of: Fix crash in of_build_overlay_info#164

Open
jharvell wants to merge 121 commits intobeagleboard:4.14from
jharvell:build-overlay-info-crash-fix
Open

of: Fix crash in of_build_overlay_info#164
jharvell wants to merge 121 commits intobeagleboard:4.14from
jharvell:build-overlay-info-crash-fix

Conversation

@jharvell
Copy link

@jharvell jharvell commented May 6, 2018

Do not set of_overlay_info attribute_group name from overlay info when there is no
overlay info device

Analysis of kernel stack trace, registers and stack along with disassembly of code pointed to ovinfo->info being zero at this point in the code.

Application of this patch prevents crash though overlays fail to load for various different reasons.

@jharvell
Copy link
Author

jharvell commented May 6, 2018

In case someone is interested in reproducing the issue, I saw the crash with several overlays I tried to load. One of these is univ-bbgw-00A0.dtbo. I built this from sources below:

joey@akita arm$ pwd
/home/joey/git/bb.org-overlays/src/arm
joey@akita arm$ git remote -v
origin  git@github.com:beagleboard/bb.org-overlays.git (fetch)
origin  git@github.com:beagleboard/bb.org-overlays.git (push)
joey@akita arm$ git status
On branch master
Your branch is up to date with 'origin/master'.

nothing to commit, working tree clean
joey@akita arm$ git --no-pager log -n1
commit 604c0926a4f7505dfc3d501301413c821e59febe (HEAD -> master, origin/master, origin/HEAD)
Author: Robert Nelson <robertcnelson@gmail.com>
Date:   Tue Apr 24 08:41:58 2018 -0500

    universal rewrite: spi0-xyz and spidev1x
    
    Signed-off-by: Robert Nelson <robertcnelson@gmail.com>

Before the fix in this PR, echoing univ-bbgw to /sys/devices/platform/bone_capemgr/slots resulted i a SEGV with the kernel debug info in dmesg pointing to ovinfo->info being NULL.

After the fix, I see the following when trying to apply the same overlay:

pip /lib/firmware # echo univ-bbgw > /sys/devices/platform/bone_capemgr/slots 
bash: echo: write error: Invalid argument

[  290.750632] bone_capemgr bone_capemgr: part_number 'univ-bbgw', version 'N/A'
[  290.758437] bone_capemgr bone_capemgr: slot #4: override
[  290.768093] bone_capemgr bone_capemgr: Using override eeprom data at slot 4
[  290.780720] bone_capemgr bone_capemgr: slot #4: 'Override Board Name,00A0,Override Manuf,univ-bbgw'
[  290.847781] OF: overlay: Failed to apply prop @/__symbols__/pruss
[  290.854191] OF: overlay: apply failed '/__symbols__'
[  290.863083] bone_capemgr bone_capemgr: slot #4: Failed to create overlay

@jharvell
Copy link
Author

jharvell commented May 7, 2018

I did a little more analysis. This crash will occur for any device blob that has a node /symbols. See the code below. An entry in ovinfo is added for each child node of tree in the first loop. ovinfo[cnt].info is populated in that case. Then there is a search for child node with name symbols. If found, it is added as the last element ovinfo. But for this case, ovinf[cnt].info is not set. And this is what the code crashes on. So if the compiler puts a /symbols node in the tree, then the kernel will crash tyring to apply it.

I made a simple overlay with one node, and compiled it. When I do strings on that blob, there is no "symbols" string in the blob and that does not trigger this bug. Several other blobs I have tried from bb.org-overlays blobs have symbols in them and trigger this crash.

	cnt = 0;
	for_each_child_of_node(tree, node) {
		err = of_fill_overlay_info(ov, node, &ovinfo[cnt]);
		if (err == 0)
			cnt++;
	}

	node = of_get_child_by_name(tree, "__symbols__");
	if (node) {
		ovinfo[cnt].overlay = node;
		ovinfo[cnt].target = of_find_node_by_path("/__symbols__");
		ovinfo[cnt].is_symbols_node = 1;

		if (!ovinfo[cnt].target) {
			pr_err("no symbols in root of device tree.\n");
			return -EINVAL;
		}

		cnt++;
	}

RobertCNelson and others added 28 commits May 7, 2018 16:08
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
This reverts commit 00f0ea7.

Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
… on bootup

Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
#https://lkml.org/lkml/2016/6/14/967

Pwm channels don't send uevents when exported, this change adds the
channels to a pwm class and set their device type to pwm_channel so
uevents are sent.

To do this properly, the device names need to change to uniquely
identify a channel.  This change is from pwmN to pwm-(chip->base):N

Signed-off-by: David Hsu <davidhsu@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
This reverts commit 956b200.

Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
ADC channel 0 photodiode detects both infrared + visible light,
but ADC channel 1 just detects infrared. However, the latter is a bit
more sensitive in that range so complete darkness or low light causes
a error condition in which the chan0 - chan1 is negative that
results in a -EAGAIN.

This patch changes the resulting lux1_input sysfs attribute message from
"Resource temporarily unavailable" to a user-grokable lux value of 0.

Signed-off-by: Matt Ranostay <mranostay@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
…oves to v4.14.x base

Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Robert Nelson <robertcnelson@gmail.com>
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
When disabling an omap device (not when removing the driver), the
device is removed but the hwmod's linger.

Fix the resource leak and the crash when calling omap_device_idle()
after the device's omap data have been removed.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Having an omap serial device without a serial aliases doesn't
work. For now fallback to using the hwmod instance.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
When using DT the driver devm_kalloc's platform data and assigns them
directly to the pdev->dev.platform variable.

This is wrong since device de-registration expects the data to be
kmalloc'ed instead, resulting in a crash.

Fix by copying the platform data to a kmalloc buffer.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
We are going to need the overlays to appear on sysfs with runtime
global properties (like master enable) so turn them into kobjects.

They have to be in sysfs so that people can have information about the
overlays applied in the system, i.e. where their targets are and whether
removal is possible. In a future more attributes can be added
in a backwards compatible manner.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
A throw once master enable switch to protect against any
further overlay applications if the administrator desires so.

A kernel command line option is provided as well.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Documentation ABI entry for overlays sysfs entries.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Document the of_overlay_disable parameter.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* A per overlay can_remove sysfs attribute that reports whether
the overlay can be removed or not due to another overlapping overlay.

* A target sysfs attribute listing the target of each fragment,
in a group named after the name of the fragment.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Documentation for the per-overlay attributes.

Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from fee3e78 to e05b0a8 Compare December 17, 2018 21:40
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 3 times, most recently from 047c0e5 to 476f427 Compare January 4, 2019 22:26
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 3 times, most recently from c63a75b to 83521be Compare January 29, 2019 16:03
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from 071e37e to 648a42b Compare February 27, 2019 19:55
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from 54d4b8a to 40d0fe1 Compare March 11, 2019 21:56
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from 62d2e67 to 8c22695 Compare March 25, 2019 14:33
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 3 times, most recently from bd61e69 to c4f86fc Compare March 28, 2019 19:55
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from 3874da8 to 364fd94 Compare April 9, 2019 16:10
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from 516af9c to e2e2c63 Compare May 24, 2019 20:08
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 2 times, most recently from cad5402 to 36fe812 Compare June 18, 2019 02:58
@RobertCNelson RobertCNelson force-pushed the 4.14 branch 5 times, most recently from 118271e to 3ac515c Compare July 30, 2019 21:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.