Commit 1e76b546 authored by Krzysztof Kozlowski's avatar Krzysztof Kozlowski Committed by Bjorn Andersson
Browse files

firmware: qcom: scm: Cleanup global '__scm' on probe failures 



If SCM driver fails the probe, it should not leave global '__scm'
variable assigned, because external users of this driver will assume the
probe finished successfully.  For example TZMEM parts ('__scm->mempool')
are initialized later in the probe, but users of it (__scm_smc_call())
rely on the '__scm' variable.

This fixes theoretical NULL pointer exception, triggered via introducing
probe deferral in SCM driver with call trace:

  qcom_tzmem_alloc+0x70/0x1ac (P)
  qcom_tzmem_alloc+0x64/0x1ac (L)
  qcom_scm_assign_mem+0x78/0x194
  qcom_rmtfs_mem_probe+0x2d4/0x38c
  platform_probe+0x68/0xc8

Fixes: 40289e35 ("firmware: qcom: scm: enable the TZ mem allocator")
Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241209-qcom-scm-missing-barriers-and-all-sort-of-srap-v2-4-9061013c8d92@linaro.org


Signed-off-by: default avatarBjorn Andersson <andersson@kernel.org>
parent b6285103

drivers/firmware/qcom/qcom_scm.c

+29 −13
Original line number Diff line number Diff line
@@ -2038,13 +2038,17 @@ static int qcom_scm_probe(struct platform_device *pdev) 


	irq = platform_get_irq_optional(pdev, 0);

	if (irq < 0) {

		if (irq != -ENXIO)

			return irq;

		if (irq != -ENXIO) {

			ret = irq;

			goto err;

		}

	} else {

		ret = devm_request_threaded_irq(__scm->dev, irq, NULL, qcom_scm_irq_handler,

						IRQF_ONESHOT, "qcom-scm", __scm);

		if (ret < 0)

			return dev_err_probe(scm->dev, ret, "Failed to request qcom-scm irq\n");

		if (ret < 0) {

			dev_err_probe(scm->dev, ret, "Failed to request qcom-scm irq\n");

			goto err;

		}

	}



	__get_convention();
@@ -2063,14 +2067,18 @@ static int qcom_scm_probe(struct platform_device *pdev) 
		qcom_scm_disable_sdi();



	ret = of_reserved_mem_device_init(__scm->dev);

	if (ret && ret != -ENODEV)

		return dev_err_probe(__scm->dev, ret,

	if (ret && ret != -ENODEV) {

		dev_err_probe(__scm->dev, ret,

			      "Failed to setup the reserved memory region for TZ mem\n");

		goto err;

	}



	ret = qcom_tzmem_enable(__scm->dev);

	if (ret)

		return dev_err_probe(__scm->dev, ret,

	if (ret) {

		dev_err_probe(__scm->dev, ret,

			      "Failed to enable the TrustZone memory allocator\n");

		goto err;

	}



	memset(&pool_config, 0, sizeof(pool_config));

	pool_config.initial_size = 0;
@@ -2078,9 +2086,11 @@ static int qcom_scm_probe(struct platform_device *pdev) 
	pool_config.max_size = SZ_256K;



	__scm->mempool = devm_qcom_tzmem_pool_new(__scm->dev, &pool_config);

	if (IS_ERR(__scm->mempool))

		return dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),

	if (IS_ERR(__scm->mempool)) {

		dev_err_probe(__scm->dev, PTR_ERR(__scm->mempool),

			      "Failed to create the SCM memory pool\n");

		goto err;

	}



	/*

	 * Initialize the QSEECOM interface.
@@ -2096,6 +2106,12 @@ static int qcom_scm_probe(struct platform_device *pdev) 
	WARN(ret < 0, "failed to initialize qseecom: %d\n", ret);



	return 0;



err:

	/* Paired with smp_load_acquire() in qcom_scm_is_available(). */

	smp_store_release(&__scm, NULL);



	return ret;

}



static void qcom_scm_shutdown(struct platform_device *pdev)