summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorFranck LENORMAND <franck.lenormand@nxp.com>2020-09-09 09:24:55 +0200
committerFranck LENORMAND <franck.lenormand@nxp.com>2020-10-05 15:12:14 +0200
commit44f8d7b44e86511f6c9b27f889667b4524e38b02 (patch)
tree10a67c5635158168a8a1c8decb11ae11a3658203 /include
parent63d6e48d13d3e223e31cb20f4e5255a3767fb603 (diff)
MLK-24759: fw: imx: scu: seco: Fix Align imx sc msg structs to 4
An error is detected by KASAN: [ 3.579068] BUG: KASAN: stack-out-of-bounds in imx_mu_generic_tx+0xf8/0x1e0 [ 3.586048] Read of size 4 at addr ffff000010097914 by task swapper/0/1 [ 3.592674] [ 3.594186] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.47-00127-gb7b4ad039c70-dirty #152 [ 3.602556] Hardware name: Freescale i.MX8DXL EVK (DT) [ 3.607706] Call trace: [ 3.610178] dump_backtrace+0x0/0x200 [ 3.613854] show_stack+0x14/0x20 [ 3.617189] dump_stack+0xf4/0x150 [ 3.620614] print_address_description.isra.9+0x6c/0x3b8 [ 3.625951] __kasan_report+0x12c/0x23c [ 3.629806] kasan_report+0xc/0x18 [ 3.633230] __asan_load4+0x94/0xb8 [ 3.636744] imx_mu_generic_tx+0xf8/0x1e0 [ 3.640776] imx_mu_send_data+0x5c/0x70 [ 3.644637] msg_submit+0x128/0x1d0 [ 3.648152] mbox_send_message+0xb8/0x1c8 [ 3.652180] imx_scu_ipc_write+0x94/0x138 [ 3.656205] imx_scu_call_rpc+0x160/0x308 [ 3.660241] imx_sc_rm_get_resource_owner+0x94/0xf0 [ 3.665139] seco_mu_probe+0x10c/0x638 [ 3.668914] platform_drv_probe+0x70/0xd8 [ 3.672945] really_probe+0x174/0x478 [ 3.676626] driver_probe_device+0x7c/0x148 [ 3.680832] device_driver_attach+0x94/0xa0 [ 3.685035] __driver_attach+0xa4/0x110 [ 3.688893] bus_for_each_dev+0xe8/0x158 [ 3.692839] driver_attach+0x30/0x40 [ 3.696432] bus_add_driver+0x234/0x2f0 [ 3.700292] driver_register+0xbc/0x1d0 [ 3.704155] __platform_driver_register+0x7c/0x88 [ 3.708889] seco_mu_driver_init+0x18/0x20 [ 3.713009] do_one_initcall+0xb4/0x254 [ 3.716870] kernel_init_freeable+0x24c/0x2f8 [ 3.721256] kernel_init+0x10/0x118 [ 3.724761] ret_from_fork+0x10/0x18 [ 3.728346] [ 3.729844] The buggy address belongs to the page: [ 3.734658] page:fffffe00002025c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 3.742943] flags: 0xffff00000000000() [ 3.746728] raw: 0ffff00000000000 fffffe00002025c8 fffffe00002025c8 0000000000000000 [ 3.754506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 3.762267] page dumped because: kasan: bad access detected [ 3.767850] [ 3.769354] addr ffff000010097914 is located in stack of task swapper/0/1 at offset 36 in frame: [ 3.778162] imx_sc_rm_get_resource_owner+0x0/0xf0 [ 3.782970] [ 3.784472] this frame has 1 object: [ 3.788065] [32, 38) 'msg' [ 3.788070] [ 3.792358] Memory state around the buggy address: [ 3.797174] ffff000010097800: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 [ 3.804419] ffff000010097880: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 3.811666] >ffff000010097900: f1 f1 06 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 [ 3.818899] ^ [ 3.822669] ffff000010097980: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 [ 3.829914] ffff000010097a00: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 00 00 00 00 00 00 [ 3.837151] ================================================================== It happens because some structure are not packed as expected by the communication protocol with the SCFW: - imx_sc_msg_seco_get_build_id - imx_sc_msg_seco_sab_msg This patch adds the tag "__packed __aligned(4)" to enforce the 4 byte alignment of the structures by the compiler Fixes: 2ccb9a596aab (SSI-87: firmware: imx: Add APIs required for secvio) Fixes: 9edf1255f89b (LF-824: fw: imx: scu: Add SECO API) Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com> Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions