mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Sascha Hauer <s.hauer@pengutronix.de>
To: Ahmad Fatoum <a.fatoum@pengutronix.de>
Cc: barebox@lists.infradead.org
Subject: Re: [PATCH 04/10] power: reset: reboot-mode: fix up node into boot device tree
Date: Mon, 21 Sep 2020 10:40:16 +0200	[thread overview]
Message-ID: <20200921084016.GG21278@pengutronix.de> (raw)
In-Reply-To: <20200916135035.7089-5-a.fatoum@pengutronix.de>

On Wed, Sep 16, 2020 at 03:50:29PM +0200, Ahmad Fatoum wrote:
> Instead of relying that the kernel and barebox device trees are in sync,
> just enforce it by having barebox fix up the device tree node it probed
> into the kernel device tree. We usually want that, but some reboot mode
> drivers might want to inhibit the fixup, e.g. because they implement
> a non-upstream binding or because they communicate with the BootROM,
> while the kernel shouldn't. For those the fixup is made optional via
> a struct reboot_mode_driver::no_fixup member.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
>  drivers/power/reset/reboot-mode.c | 39 +++++++++++++++++++++++++++++++
>  include/linux/reboot-mode.h       |  1 +
>  2 files changed, 40 insertions(+)
> 
> diff --git a/drivers/power/reset/reboot-mode.c b/drivers/power/reset/reboot-mode.c
> index 5992a2acd99a..5fc29ebf8091 100644
> --- a/drivers/power/reset/reboot-mode.c
> +++ b/drivers/power/reset/reboot-mode.c
> @@ -52,6 +52,42 @@ static int reboot_mode_add_param(struct device_d *dev,
>  	return PTR_ERR_OR_ZERO(param);
>  }
>  
> +static struct device_node *of_get_node_by_reproducible_name(struct device_node *dstroot,
> +							    struct device_node *srcnp)
> +{
> +	struct device_node *dstnp;
> +	char *name;
> +
> +	name = of_get_reproducible_name(srcnp);
> +	dstnp = of_find_node_by_reproducible_name(dstroot, name);
> +	free(name);
> +
> +	return dstnp;
> +}
> +
> +static int of_reboot_mode_fixup(struct device_node *root, void *ctx)
> +{
> +	struct reboot_mode_driver *reboot = ctx;
> +	struct device_node *dstnp, *srcnp, *dstparent;
> +
> +	srcnp = reboot->dev->device_node;
> +
> +	dstnp = of_get_node_by_reproducible_name(root, srcnp);
> +	if (dstnp) {
> +		dstparent = dstnp->parent;
> +		of_delete_node(dstnp);
> +	} else {
> +		dstparent = of_get_node_by_reproducible_name(root, srcnp->parent);
> +	}

\o/ barebox KASan found it's first bug!

This ends up in:

ERROR: ==================================================================
ERROR: BUG: KASAN: out-of-bounds in of_copy_node+0x11/0x8e
ERROR: Read of size 4 at addr 2fe0a2a0
ERROR:
WARNING: [<4fcd3101>] (unwind_backtrace+0x1/0x100) from [<4fc93e0d>] (kasan_report+0xa9/0x214)
WARNING: [<4fc93e0d>] (kasan_report+0xa9/0x214) from [<4fc7cd83>] (of_copy_node+0x11/0x8e)
WARNING: [<4fc7cd83>] (of_copy_node+0x11/0x8e) from [<4fc811b7>] (of_reboot_mode_fixup+0x9f/0xd4)
WARNING: [<4fc811b7>] (of_reboot_mode_fixup+0x9f/0xd4) from [<4fc0bda9>] (of_fix_tree+0x3d/0x70)
WARNING: [<4fc0bda9>] (of_fix_tree+0x3d/0x70) from [<4fc0bdf5>] (of_get_fixed_tree+0x19/0x2c)
WARNING: [<4fc0bdf5>] (of_get_fixed_tree+0x19/0x2c) from [<4fc05ae9>] (bootm_get_devicetree+0x279/0x2b4)
WARNING: [<4fc05ae9>] (bootm_get_devicetree+0x279/0x2b4) from [<4fcd2111>] (__do_bootm_linux+0xdd/0x1e0)
WARNING: [<4fcd2111>] (__do_bootm_linux+0xdd/0x1e0) from [<4fcd2299>] (do_bootm_linux+0x85/0xa0)
WARNING: [<4fcd2299>] (do_bootm_linux+0x85/0xa0) from [<4fc062bd>] (bootm_boot+0x60d/0x684)
WARNING: [<4fc062bd>] (bootm_boot+0x60d/0x684) from [<4fc820d5>] (do_bootm+0x1b5/0x1f8)
WARNING: [<4fc820d5>] (do_bootm+0x1b5/0x1f8) from [<4fc06dd3>] (execute_command+0x6b/0xb4)
WARNING: [<4fc06dd3>] (execute_command+0x6b/0xb4) from [<4fc0f835>] (run_list_real+0x985/0x9f0)
WARNING: [<4fc0f835>] (run_list_real+0x985/0x9f0) from [<4fc0ed05>] (parse_stream_outer+0x221/0x2a8)
WARNING: [<4fc0ed05>] (parse_stream_outer+0x221/0x2a8) from [<4fc0fc0b>] (run_shell+0x8b/0xdc)
WARNING: [<4fc0fc0b>] (run_shell+0x8b/0xdc) from [<4fc01895>] (run_init+0x205/0x264)
WARNING: [<4fc01895>] (run_init+0x205/0x264) from [<4fc01933>] (start_barebox+0x3f/0xa4)
WARNING: [<4fc01933>] (start_barebox+0x3f/0xa4) from [<4fcd09f9>] (barebox_non_pbl_start+0x131/0x174)
WARNING: [<4fcd09f9>] (barebox_non_pbl_start+0x131/0x174) from [<4fc00005>] (__bare_init_start+0x1/0xc)

This happens in the case when the to-be-fixed up device tree is the internal
device tree itself. Here of_delete_node(dstnp) is called, but this is
also srcnp which is then read from.

The solution might also be to make sure we make a copy of the internal
tree before doing a of_fixup on it.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

  reply	other threads:[~2020-09-21  8:40 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-16 13:50 [PATCH 00/10] power: reset: add support for syscon reboot modes Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 01/10] usbgadget: autostart: support delayed usbgadget.autostart=1 Ahmad Fatoum
2020-09-16 13:55   ` Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 02/10] drivers: add reboot-mode infrastructure Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 03/10] power: reset: reboot-mode: port syscon-reboot-mode support Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 04/10] power: reset: reboot-mode: fix up node into boot device tree Ahmad Fatoum
2020-09-21  8:40   ` Sascha Hauer [this message]
2020-09-21  9:11     ` Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 05/10] defaultenv: provide defaults for generic reboot modes Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 06/10] ARM: dts: stm32mp: setup syscon-reboot-mode on TAMP general purpose register Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 07/10] ARM: stm32mp: remove custom reboot mode logic from arch code Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 08/10] power: reset: reboot-mode: support multi-word magic Ahmad Fatoum
2020-09-16 13:50 ` [PATCH 09/10] power: reset: syscon-reboot-mode: support multi-word reboot modes Ahmad Fatoum
2020-10-07  8:18   ` Sascha Hauer
2020-09-16 13:50 ` [PATCH 10/10] ARM: dts: i.MX6qdl: define BootROM reboot-mode on top of SRC_GPR{9, 10} Ahmad Fatoum

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200921084016.GG21278@pengutronix.de \
    --to=s.hauer@pengutronix.de \
    --cc=a.fatoum@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox