rproc_add() called by rproc probe function failure will tear down all the resources including do device_del() and remove subdev etc. If rproc_report_crash() is called in this path, the rproc_crash_handler_work could be excuted asynchronously, rproc_boot_recovery()->rproc_stop() will be called with recovery enabled, which may cause NULL pointer dereference if the resource has already been cleaned up.
[ 5.251483] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000300 [ 5.260499] Mem abort info: [ 5.263384] ESR = 0x0000000096000006 [ 5.267248] EC = 0x25: DABT (current EL), IL = 32 bits [ 5.272711] SET = 0, FnV = 0 [ 5.275865] EA = 0, S1PTW = 0 [ 5.279106] FSC = 0x06: level 2 translation fault [ 5.284125] Data abort info: [ 5.287101] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 5.292742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 5.297939] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 5.303400] user pgtable: 4k pages, 48-bit VAs, pgdp=000000089e086000 [ 5.310022] [0000000000000300] pgd=080000089e087403, p4d=080000089e087403, pud=080000089e088403, pmd=0000000000000000 [ 5.320917] Internal error: Oops: 0000000096000006 [#1] SMP [ 5.392494] Hardware name: Qualcomm Technologies, Inc. Kaanapali QRD (DT) [ 5.399466] Workqueue: rproc_recovery_wq rproc_crash_handler_work [ 5.405729] pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 5.412879] pc : qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] [ 5.419674] lr : glink_subdev_stop+0x1c/0x30 [qcom_common] [ 5.425308] sp : ffff800080ffbc90 [ 5.428724] x29: ffff800080ffbc90 x28: ffff00081be833f0 x27: ffff000800059c00 [ 5.436053] x26: 0000000000000000 x25: ffff000800a56f80 x24: 61c8864680b583eb [ 5.443384] x23: ffff00081be83038 x22: 0000000000000001 x21: ffff00081be83000 [ 5.450714] x20: ffff00081be833c0 x19: 0000000000000000 x18: 0000000000000010 [ 5.458043] x17: 0000000000000000 x16: 0000000000000000 x15: ffff0008042684f8 [ 5.465374] x14: 00000000000002dd x13: ffff0008042684f8 x12: ffffd37f69f967a0 [ 5.472705] x11: ffffd37f6a006800 x10: ffffd37f69fee7c0 x9 : ffffd37f69fee818 [ 5.480036] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 [ 5.487366] x5 : ffff000d6536d408 x4 : 0000000000000001 x3 : 0000000000000000 [ 5.494697] x2 : ffffd37f5703c18c x1 : 0000000000000001 x0 : 0000000000000000 [ 5.502028] Call trace: [ 5.504549] qcom_glink_smem_unregister+0x14/0x48 [qcom_glink_smem] (P) [ 5.511344] glink_subdev_stop+0x1c/0x30 [qcom_common] [ 5.516622] rproc_stop+0x58/0x17c [ 5.520127] rproc_trigger_recovery+0xb0/0x150 [ 5.524693] rproc_crash_handler_work+0xa4/0xc4 [ 5.529346] process_scheduled_works+0x18c/0x2d8 [ 5.534092] worker_thread+0x144/0x280 [ 5.537952] kthread+0x124/0x138 [ 5.541280] ret_from_fork+0x10/0x20 [ 5.544965] Code: a9be7bfd 910003fd a90153f3 aa0003f3 (b9430000) [ 5.551224] ---[ end trace 0000000000000000 ]--- So set recovery_disabled during rproc_add(). Signed-off-by: Jingyi Wang <[email protected]> --- drivers/remoteproc/remoteproc_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index b087ed21858a..f66dde712cec 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -2286,7 +2286,10 @@ int rproc_add(struct rproc *rproc) { struct device *dev = &rproc->dev; int ret; + bool rproc_recovery_save; + rproc_recovery_save = rproc->recovery_disabled; + rproc->recovery_disabled = true; ret = rproc_validate(rproc); if (ret < 0) return ret; @@ -2319,6 +2322,7 @@ int rproc_add(struct rproc *rproc) list_add_rcu(&rproc->node, &rproc_list); mutex_unlock(&rproc_list_mutex); + rproc->recovery_disabled = rproc_recovery_save; return 0; rproc_remove_dev: -- 2.25.1
