mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
![Krzysztof Kozlowski](/assets/img/avatar_default.png)
After unbinding the driver memory was corrupted by double free of
clk_lookup structure. This lead to OOPS when re-binding the driver
again.
The driver allocated memory for 'clk_lookup' with devm_kzalloc. During
driver removal this memory was freed twice: once by clkdev_drop() and
second by devm code.
Kernel panic log:
[ 30.839284] Unable to handle kernel paging request at virtual address 5f343173
[ 30.846476] pgd = dee14000
[ 30.849165] [5f343173] *pgd=00000000
[ 30.852703] Internal error: Oops: 805 [#1] PREEMPT SMP ARM
[ 30.858166] Modules linked in:
[ 30.861208] CPU: 0 PID: 1 Comm: bash Not tainted 3.16.0-rc2-00239-g94bdf617b07e-dirty #40
[ 30.869364] task: df478000 ti: df480000 task.ti: df480000
[ 30.874752] PC is at clkdev_add+0x2c/0x38
[ 30.878738] LR is at clkdev_add+0x18/0x38
[ 30.882732] pc : [<c0350908>] lr : [<c03508f4>] psr: 60000013
[ 30.882732] sp : df481e78 ip : 00000001 fp : c0700ed8
[ 30.894187] r10: 0000000c r9 : 00000000 r8 : c07b0e3c
[ 30.899396] r7 : 00000002 r6 : df45f9d0 r5 : df421390 r4 : c0700d6c
[ 30.905906] r3 : 5f343173 r2 : c0700d84 r1 : 60000013 r0 : c0700d6c
[ 30.912417] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 30.919534] Control: 10c53c7d Table: 5ee1406a DAC: 00000015
[ 30.925262] Process bash (pid: 1, stack limit = 0xdf480240)
[ 30.930817] Stack: (0xdf481e78 to 0xdf482000)
[ 30.935159] 1e60: 00001000 df6de610
[ 30.943321] 1e80: df7f4558 c0355650 c05ec6ec c0700eb0 df6de600 df7f4510 dec9d69c 00000014
[ 30.951480] 1ea0: 00167b48 df6de610 c0700e30 c0713518 00000000 c0700e30 dec9d69c 00000006
[ 30.959639] 1ec0: 00167b48 c02c1b7c c02c1b64 df6de610 c07aff48 c02c0420 c06fb150 c047cc20
[ 30.967798] 1ee0: df6de610 df6de610 c0700e30 df6de644 c06fb150 0000000c dec9d690 c02bef90
[ 30.975957] 1f00: dec9c6c0 dece4c00 df481f80 dece4c00 0000000c c02be73c 0000000c c016ca8c
[ 30.984116] 1f20: c016ca48 00000000 00000000 c016c1f4 00000000 00000000 b6f18000 df481f80
[ 30.992276] 1f40: df7f66c0 0000000c df480000 df480000 b6f18000 c011094c df47839c 60000013
[ 31.000435] 1f60: 00000000 00000000 df7f66c0 df7f66c0 0000000c df480000 b6f18000 c0110dd4
[ 31.008594] 1f80: 00000000 00000000 0000000c b6ec05d8 0000000c b6f18000 00000004 c000f2a8
[ 31.016753] 1fa0: 00001000 c000f0e0 b6ec05d8 0000000c 00000001 b6f18000 0000000c 00000000
[ 31.024912] 1fc0: b6ec05d8 0000000c b6f18000 00000004 0000000c 00000001 00000000 00167b48
[ 31.033071] 1fe0: 00000000 bed83a80 b6e004f0 b6e5122c 60000010 00000001 ffffffff ffffffff
[ 31.041248] [<c0350908>] (clkdev_add) from [<c0355650>] (s2mps11_clk_probe+0x2b4/0x3b4)
[ 31.049223] [<c0355650>] (s2mps11_clk_probe) from [<c02c1b7c>] (platform_drv_probe+0x18/0x48)
[ 31.057728] [<c02c1b7c>] (platform_drv_probe) from [<c02c0420>] (driver_probe_device+0x13c/0x384)
[ 31.066579] [<c02c0420>] (driver_probe_device) from [<c02bef90>] (bind_store+0x88/0xd8)
[ 31.074564] [<c02bef90>] (bind_store) from [<c02be73c>] (drv_attr_store+0x20/0x2c)
[ 31.082118] [<c02be73c>] (drv_attr_store) from [<c016ca8c>] (sysfs_kf_write+0x44/0x48)
[ 31.090016] [<c016ca8c>] (sysfs_kf_write) from [<c016c1f4>] (kernfs_fop_write+0xc0/0x17c)
[ 31.098176] [<c016c1f4>] (kernfs_fop_write) from [<c011094c>] (vfs_write+0xa0/0x1c4)
[ 31.105899] [<c011094c>] (vfs_write) from [<c0110dd4>] (SyS_write+0x40/0x8c)
[ 31.112931] [<c0110dd4>] (SyS_write) from [<c000f0e0>] (ret_fast_syscall+0x0/0x3c)
[ 31.120481] Code: e2842018 e584501c e1a00004 e885000c (e5835000)
[ 31.126596] ---[ end trace efad45bfa3a61b05 ]---
[ 31.131181] Kernel panic - not syncing: Fatal exception
[ 31.136368] CPU1: stopping
[ 31.139054] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G D 3.16.0-rc2-00239-g94bdf617b07e-dirty #40
[ 31.148697] [<c0016480>] (unwind_backtrace) from [<c0012950>] (show_stack+0x10/0x14)
[ 31.156419] [<c0012950>] (show_stack) from [<c0480db8>] (dump_stack+0x80/0xcc)
[ 31.163622] [<c0480db8>] (dump_stack) from [<c001499c>] (handle_IPI+0x130/0x15c)
[ 31.170998] [<c001499c>] (handle_IPI) from [<c000862c>] (gic_handle_irq+0x60/0x68)
[ 31.178549] [<c000862c>] (gic_handle_irq) from [<c0013480>] (__irq_svc+0x40/0x70)
[ 31.186009] Exception stack(0xdf4bdf88 to 0xdf4bdfd0)
[ 31.191046] df80: ffffffed 00000000 00000000 00000000 df4bc000 c06d042c
[ 31.199207] dfa0: 00000000 ffffffed c06d03c0 00000000 c070c288 00000000 00000000 df4bdfd0
[ 31.207363] dfc0: c0010324 c0010328 60000013 ffffffff
[ 31.212402] [<c0013480>] (__irq_svc) from [<c0010328>] (arch_cpu_idle+0x28/0x30)
[ 31.219783] [<c0010328>] (arch_cpu_idle) from [<c005f150>] (cpu_startup_entry+0x2c4/0x3f0)
[ 31.228027] [<c005f150>] (cpu_startup_entry) from [<400086c4>] (0x400086c4)
[ 31.234968] ---[ end Kernel panic - not syncing: Fatal exception
Fixes: 7cc560dea4
("clk: s2mps11: Add support for s2mps11")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Reviewed-by: Yadwinder Singh Brar <yadi.brar@samsung.com>
Signed-off-by: Mike Turquette <mturquette@linaro.org>
323 lines
7.7 KiB
C
323 lines
7.7 KiB
C
/*
|
|
* clk-s2mps11.c - Clock driver for S2MPS11.
|
|
*
|
|
* Copyright (C) 2013,2014 Samsung Electornics
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/err.h>
|
|
#include <linux/of.h>
|
|
#include <linux/clkdev.h>
|
|
#include <linux/regmap.h>
|
|
#include <linux/clk-provider.h>
|
|
#include <linux/platform_device.h>
|
|
#include <linux/mfd/samsung/s2mps11.h>
|
|
#include <linux/mfd/samsung/s2mps14.h>
|
|
#include <linux/mfd/samsung/s5m8767.h>
|
|
#include <linux/mfd/samsung/core.h>
|
|
|
|
#define s2mps11_name(a) (a->hw.init->name)
|
|
|
|
static struct clk **clk_table;
|
|
static struct clk_onecell_data clk_data;
|
|
|
|
enum {
|
|
S2MPS11_CLK_AP = 0,
|
|
S2MPS11_CLK_CP,
|
|
S2MPS11_CLK_BT,
|
|
S2MPS11_CLKS_NUM,
|
|
};
|
|
|
|
struct s2mps11_clk {
|
|
struct sec_pmic_dev *iodev;
|
|
struct device_node *clk_np;
|
|
struct clk_hw hw;
|
|
struct clk *clk;
|
|
struct clk_lookup *lookup;
|
|
u32 mask;
|
|
bool enabled;
|
|
unsigned int reg;
|
|
};
|
|
|
|
static struct s2mps11_clk *to_s2mps11_clk(struct clk_hw *hw)
|
|
{
|
|
return container_of(hw, struct s2mps11_clk, hw);
|
|
}
|
|
|
|
static int s2mps11_clk_prepare(struct clk_hw *hw)
|
|
{
|
|
struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
|
|
int ret;
|
|
|
|
ret = regmap_update_bits(s2mps11->iodev->regmap_pmic,
|
|
s2mps11->reg,
|
|
s2mps11->mask, s2mps11->mask);
|
|
if (!ret)
|
|
s2mps11->enabled = true;
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void s2mps11_clk_unprepare(struct clk_hw *hw)
|
|
{
|
|
struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
|
|
int ret;
|
|
|
|
ret = regmap_update_bits(s2mps11->iodev->regmap_pmic, s2mps11->reg,
|
|
s2mps11->mask, ~s2mps11->mask);
|
|
|
|
if (!ret)
|
|
s2mps11->enabled = false;
|
|
}
|
|
|
|
static int s2mps11_clk_is_enabled(struct clk_hw *hw)
|
|
{
|
|
struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
|
|
|
|
return s2mps11->enabled;
|
|
}
|
|
|
|
static unsigned long s2mps11_clk_recalc_rate(struct clk_hw *hw,
|
|
unsigned long parent_rate)
|
|
{
|
|
struct s2mps11_clk *s2mps11 = to_s2mps11_clk(hw);
|
|
if (s2mps11->enabled)
|
|
return 32768;
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
static struct clk_ops s2mps11_clk_ops = {
|
|
.prepare = s2mps11_clk_prepare,
|
|
.unprepare = s2mps11_clk_unprepare,
|
|
.is_enabled = s2mps11_clk_is_enabled,
|
|
.recalc_rate = s2mps11_clk_recalc_rate,
|
|
};
|
|
|
|
static struct clk_init_data s2mps11_clks_init[S2MPS11_CLKS_NUM] = {
|
|
[S2MPS11_CLK_AP] = {
|
|
.name = "s2mps11_ap",
|
|
.ops = &s2mps11_clk_ops,
|
|
.flags = CLK_IS_ROOT,
|
|
},
|
|
[S2MPS11_CLK_CP] = {
|
|
.name = "s2mps11_cp",
|
|
.ops = &s2mps11_clk_ops,
|
|
.flags = CLK_IS_ROOT,
|
|
},
|
|
[S2MPS11_CLK_BT] = {
|
|
.name = "s2mps11_bt",
|
|
.ops = &s2mps11_clk_ops,
|
|
.flags = CLK_IS_ROOT,
|
|
},
|
|
};
|
|
|
|
static struct clk_init_data s2mps14_clks_init[S2MPS11_CLKS_NUM] = {
|
|
[S2MPS11_CLK_AP] = {
|
|
.name = "s2mps14_ap",
|
|
.ops = &s2mps11_clk_ops,
|
|
.flags = CLK_IS_ROOT,
|
|
},
|
|
[S2MPS11_CLK_BT] = {
|
|
.name = "s2mps14_bt",
|
|
.ops = &s2mps11_clk_ops,
|
|
.flags = CLK_IS_ROOT,
|
|
},
|
|
};
|
|
|
|
static struct device_node *s2mps11_clk_parse_dt(struct platform_device *pdev,
|
|
struct clk_init_data *clks_init)
|
|
{
|
|
struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
|
|
struct device_node *clk_np;
|
|
int i;
|
|
|
|
if (!iodev->dev->of_node)
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
clk_np = of_get_child_by_name(iodev->dev->of_node, "clocks");
|
|
if (!clk_np) {
|
|
dev_err(&pdev->dev, "could not find clock sub-node\n");
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
|
|
for (i = 0; i < S2MPS11_CLKS_NUM; i++) {
|
|
if (!clks_init[i].name)
|
|
continue; /* Skip clocks not present in some devices */
|
|
of_property_read_string_index(clk_np, "clock-output-names", i,
|
|
&clks_init[i].name);
|
|
}
|
|
|
|
return clk_np;
|
|
}
|
|
|
|
static int s2mps11_clk_probe(struct platform_device *pdev)
|
|
{
|
|
struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
|
|
struct s2mps11_clk *s2mps11_clks, *s2mps11_clk;
|
|
unsigned int s2mps11_reg;
|
|
struct clk_init_data *clks_init;
|
|
int i, ret = 0;
|
|
u32 val;
|
|
|
|
s2mps11_clks = devm_kzalloc(&pdev->dev, sizeof(*s2mps11_clk) *
|
|
S2MPS11_CLKS_NUM, GFP_KERNEL);
|
|
if (!s2mps11_clks)
|
|
return -ENOMEM;
|
|
|
|
s2mps11_clk = s2mps11_clks;
|
|
|
|
clk_table = devm_kzalloc(&pdev->dev, sizeof(struct clk *) *
|
|
S2MPS11_CLKS_NUM, GFP_KERNEL);
|
|
if (!clk_table)
|
|
return -ENOMEM;
|
|
|
|
switch(platform_get_device_id(pdev)->driver_data) {
|
|
case S2MPS11X:
|
|
s2mps11_reg = S2MPS11_REG_RTC_CTRL;
|
|
clks_init = s2mps11_clks_init;
|
|
break;
|
|
case S2MPS14X:
|
|
s2mps11_reg = S2MPS14_REG_RTCCTRL;
|
|
clks_init = s2mps14_clks_init;
|
|
break;
|
|
case S5M8767X:
|
|
s2mps11_reg = S5M8767_REG_CTRL1;
|
|
clks_init = s2mps11_clks_init;
|
|
break;
|
|
default:
|
|
dev_err(&pdev->dev, "Invalid device type\n");
|
|
return -EINVAL;
|
|
};
|
|
|
|
/* Store clocks of_node in first element of s2mps11_clks array */
|
|
s2mps11_clks->clk_np = s2mps11_clk_parse_dt(pdev, clks_init);
|
|
if (IS_ERR(s2mps11_clks->clk_np))
|
|
return PTR_ERR(s2mps11_clks->clk_np);
|
|
|
|
for (i = 0; i < S2MPS11_CLKS_NUM; i++, s2mps11_clk++) {
|
|
if (!clks_init[i].name)
|
|
continue; /* Skip clocks not present in some devices */
|
|
s2mps11_clk->iodev = iodev;
|
|
s2mps11_clk->hw.init = &clks_init[i];
|
|
s2mps11_clk->mask = 1 << i;
|
|
s2mps11_clk->reg = s2mps11_reg;
|
|
|
|
ret = regmap_read(s2mps11_clk->iodev->regmap_pmic,
|
|
s2mps11_clk->reg, &val);
|
|
if (ret < 0)
|
|
goto err_reg;
|
|
|
|
s2mps11_clk->enabled = val & s2mps11_clk->mask;
|
|
|
|
s2mps11_clk->clk = devm_clk_register(&pdev->dev,
|
|
&s2mps11_clk->hw);
|
|
if (IS_ERR(s2mps11_clk->clk)) {
|
|
dev_err(&pdev->dev, "Fail to register : %s\n",
|
|
s2mps11_name(s2mps11_clk));
|
|
ret = PTR_ERR(s2mps11_clk->clk);
|
|
goto err_reg;
|
|
}
|
|
|
|
s2mps11_clk->lookup = clkdev_alloc(s2mps11_clk->clk,
|
|
s2mps11_name(s2mps11_clk), NULL);
|
|
if (!s2mps11_clk->lookup) {
|
|
ret = -ENOMEM;
|
|
goto err_lup;
|
|
}
|
|
|
|
clkdev_add(s2mps11_clk->lookup);
|
|
}
|
|
|
|
for (i = 0; i < S2MPS11_CLKS_NUM; i++) {
|
|
/* Skip clocks not present on S2MPS14 */
|
|
if (!clks_init[i].name)
|
|
continue;
|
|
clk_table[i] = s2mps11_clks[i].clk;
|
|
}
|
|
|
|
clk_data.clks = clk_table;
|
|
clk_data.clk_num = S2MPS11_CLKS_NUM;
|
|
of_clk_add_provider(s2mps11_clks->clk_np, of_clk_src_onecell_get,
|
|
&clk_data);
|
|
|
|
platform_set_drvdata(pdev, s2mps11_clks);
|
|
|
|
return ret;
|
|
err_lup:
|
|
devm_clk_unregister(&pdev->dev, s2mps11_clk->clk);
|
|
err_reg:
|
|
while (s2mps11_clk > s2mps11_clks) {
|
|
if (s2mps11_clk->lookup) {
|
|
clkdev_drop(s2mps11_clk->lookup);
|
|
devm_clk_unregister(&pdev->dev, s2mps11_clk->clk);
|
|
}
|
|
s2mps11_clk--;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int s2mps11_clk_remove(struct platform_device *pdev)
|
|
{
|
|
struct s2mps11_clk *s2mps11_clks = platform_get_drvdata(pdev);
|
|
int i;
|
|
|
|
of_clk_del_provider(s2mps11_clks[0].clk_np);
|
|
/* Drop the reference obtained in s2mps11_clk_parse_dt */
|
|
of_node_put(s2mps11_clks[0].clk_np);
|
|
|
|
for (i = 0; i < S2MPS11_CLKS_NUM; i++) {
|
|
/* Skip clocks not present on S2MPS14 */
|
|
if (!s2mps11_clks[i].lookup)
|
|
continue;
|
|
clkdev_drop(s2mps11_clks[i].lookup);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct platform_device_id s2mps11_clk_id[] = {
|
|
{ "s2mps11-clk", S2MPS11X},
|
|
{ "s2mps14-clk", S2MPS14X},
|
|
{ "s5m8767-clk", S5M8767X},
|
|
{ },
|
|
};
|
|
MODULE_DEVICE_TABLE(platform, s2mps11_clk_id);
|
|
|
|
static struct platform_driver s2mps11_clk_driver = {
|
|
.driver = {
|
|
.name = "s2mps11-clk",
|
|
.owner = THIS_MODULE,
|
|
},
|
|
.probe = s2mps11_clk_probe,
|
|
.remove = s2mps11_clk_remove,
|
|
.id_table = s2mps11_clk_id,
|
|
};
|
|
|
|
static int __init s2mps11_clk_init(void)
|
|
{
|
|
return platform_driver_register(&s2mps11_clk_driver);
|
|
}
|
|
subsys_initcall(s2mps11_clk_init);
|
|
|
|
static void __init s2mps11_clk_cleanup(void)
|
|
{
|
|
platform_driver_unregister(&s2mps11_clk_driver);
|
|
}
|
|
module_exit(s2mps11_clk_cleanup);
|
|
|
|
MODULE_DESCRIPTION("S2MPS11 Clock Driver");
|
|
MODULE_AUTHOR("Yadwinder Singh Brar <yadi.brar@samsung.com>");
|
|
MODULE_LICENSE("GPL");
|