Commit 0259f522 authored Feb 11, 2016 by Jon Hunter Committed by Thierry Reding Apr 05, 2016

soc/tegra: pmc: Restore base address on probe failure

During early initialisation, the PMC registers are mapped and the PMC SoC
data is populated in the PMC data structure. This allows other drivers
access the PMC register space, via the public Tegra PMC APIs, prior to
probing the PMC device.

When the PMC device is probed, the PMC registers are mapped again and if
successful the initial mapping is freed. If the probing of the PMC device
fails after the registers are remapped, then the registers will be
unmapped and hence the pointer to the PMC registers will be invalid. This
could lead to a potential crash, because once the PMC SoC data pointer is
populated, the driver assumes that the PMC register mapping is also valid
and a user calling any of the public Tegra PMC APIs could trigger an
exception because these APIs don't check that the mapping is still valid.

Fix this by updating the mapping and freeing the original mapping only if
probing the PMC device is successful.

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>

parent 668419af

drivers/soc/tegra/pmc.c

+8 −6

Original line number	Original line	Diff line number	Diff line
	@@ -807,7 +807,7 @@ out:

	static int tegra_pmc_probe(struct platform_device *pdev)		static int tegra_pmc_probe(struct platform_device *pdev)
	{		{
	void __iomem *base = pmc->base;		void __iomem base, tmp;
	struct resource *res;		struct resource *res;
	int err;		int err;

	@@ -817,11 +817,9 @@ static int tegra_pmc_probe(struct platform_device *pdev)

	/* take over the memory region from the early initialization */		/* take over the memory region from the early initialization */
	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
	pmc->base = devm_ioremap_resource(&pdev->dev, res);		base = devm_ioremap_resource(&pdev->dev, res);
	if (IS_ERR(pmc->base))		if (IS_ERR(base))
	return PTR_ERR(pmc->base);		return PTR_ERR(base);

	iounmap(base);

	pmc->clk = devm_clk_get(&pdev->dev, "pclk");		pmc->clk = devm_clk_get(&pdev->dev, "pclk");
	if (IS_ERR(pmc->clk)) {		if (IS_ERR(pmc->clk)) {
	@@ -850,6 +848,10 @@ static int tegra_pmc_probe(struct platform_device *pdev)
	return err;		return err;
	}		}

			tmp = pmc->base;
			pmc->base = base;
			iounmap(tmp);

	return 0;		return 0;
	}		}

Admin message