• Sudeep Holla's avatar
    firmware: arm_ffa: Check if ffa_driver remove is present before executing · b71b5524
    Sudeep Holla authored
    Currently ffa_drv->remove() is called unconditionally from
    ffa_device_remove(). Since the driver registration doesn't check for it
    and allows it to be registered without .remove callback, we need to check
    for the presence of it before executing it from ffa_device_remove() to
    above a NULL pointer dereference like the one below:
    
      | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
      | Mem abort info:
      |   ESR = 0x0000000086000004
      |   EC = 0x21: IABT (current EL), IL = 32 bits
      |   SET = 0, FnV = 0
      |   EA = 0, S1PTW = 0
      |   FSC = 0x04: level 0 translation fault
      | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000
      | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
      | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
      | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6
      | Hardware name: FVP Base RevC (DT)
      | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c)
      | pc : 0x0
      | lr : ffa_device_remove+0x20/0x2c
      | Call trace:
      |  0x0
      |  device_release_driver_internal+0x16c/0x260
      |  driver_detach+0x90/0xd0
      |  bus_remove_driver+0xdc/0x11c
      |  driver_unregister+0x30/0x54
      |  ffa_driver_unregister+0x14/0x20
      |  cleanup_module+0x18/0xeec
      |  __arm64_sys_delete_module+0x234/0x378
      |  invoke_syscall+0x40/0x108
      |  el0_svc_common+0xb4/0xf0
      |  do_el0_svc+0x30/0xa4
      |  el0_svc+0x2c/0x7c
      |  el0t_64_sync_handler+0x84/0xf0
      |  el0t_64_sync+0x190/0x194
    
    Fixes: 244f5d59 ("firmware: arm_ffa: Add missing remove callback to ffa_bus_type")
    Link: https://lore.kernel.org/r/20230419-ffa_fixes_6-4-v2-1-d9108e43a176@arm.comSigned-off-by: default avatarSudeep Holla <sudeep.holla@arm.com>
    b71b5524
bus.c 4.68 KB