MLK-24759: fw: imx: scu: rm: Fix Align imx sc msg structs to 4

An error is detected by KASAN:
[    3.579068] BUG: KASAN: stack-out-of-bounds in imx_mu_generic_tx+0xf8/0x1e0
[    3.586048] Read of size 4 at addr ffff000010097914 by task swapper/0/1
[    3.592674]
[    3.594186] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.47-00127-gb7b4ad039c70-dirty #152
[    3.602556] Hardware name: Freescale i.MX8DXL EVK (DT)
[    3.607706] Call trace:
[    3.610178]  dump_backtrace+0x0/0x200
[    3.613854]  show_stack+0x14/0x20
[    3.617189]  dump_stack+0xf4/0x150
[    3.620614]  print_address_description.isra.9+0x6c/0x3b8
[    3.625951]  __kasan_report+0x12c/0x23c
[    3.629806]  kasan_report+0xc/0x18
[    3.633230]  __asan_load4+0x94/0xb8
[    3.636744]  imx_mu_generic_tx+0xf8/0x1e0
[    3.640776]  imx_mu_send_data+0x5c/0x70
[    3.644637]  msg_submit+0x128/0x1d0
[    3.648152]  mbox_send_message+0xb8/0x1c8
[    3.652180]  imx_scu_ipc_write+0x94/0x138
[    3.656205]  imx_scu_call_rpc+0x160/0x308
[    3.660241]  imx_sc_rm_get_resource_owner+0x94/0xf0
[    3.665139]  seco_mu_probe+0x10c/0x638
[    3.668914]  platform_drv_probe+0x70/0xd8
[    3.672945]  really_probe+0x174/0x478
[    3.676626]  driver_probe_device+0x7c/0x148
[    3.680832]  device_driver_attach+0x94/0xa0
[    3.685035]  __driver_attach+0xa4/0x110
[    3.688893]  bus_for_each_dev+0xe8/0x158
[    3.692839]  driver_attach+0x30/0x40
[    3.696432]  bus_add_driver+0x234/0x2f0
[    3.700292]  driver_register+0xbc/0x1d0
[    3.704155]  __platform_driver_register+0x7c/0x88
[    3.708889]  seco_mu_driver_init+0x18/0x20
[    3.713009]  do_one_initcall+0xb4/0x254
[    3.716870]  kernel_init_freeable+0x24c/0x2f8
[    3.721256]  kernel_init+0x10/0x118
[    3.724761]  ret_from_fork+0x10/0x18
[    3.728346]
[    3.729844] The buggy address belongs to the page:
[    3.734658] page:fffffe00002025c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
[    3.742943] flags: 0xffff00000000000()
[    3.746728] raw: 0ffff00000000000 fffffe00002025c8 fffffe00002025c8 0000000000000000
[    3.754506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[    3.762267] page dumped because: kasan: bad access detected
[    3.767850]
[    3.769354] addr ffff000010097914 is located in stack of task swapper/0/1 at offset 36 in frame:
[    3.778162]  imx_sc_rm_get_resource_owner+0x0/0xf0
[    3.782970]
[    3.784472] this frame has 1 object:
[    3.788065]  [32, 38) 'msg'
[    3.788070]
[    3.792358] Memory state around the buggy address:
[    3.797174]  ffff000010097800: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3
[    3.804419]  ffff000010097880: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
[    3.811666] >ffff000010097900: f1 f1 06 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
[    3.818899]                          ^
[    3.822669]  ffff000010097980: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
[    3.829914]  ffff000010097a00: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 00 00 00 00 00 00
[    3.837151] ==================================================================

It happens because some structure are not packed as expected by the communication
protocol with the SCFW:
- imx_sc_msg_rm_get_resource_owner
- imx_sc_msg_rm_find_memreg

This patch adds the tag "__packed __aligned(4)" to enforce
the 4 byte alignment of the structures by the compiler

Fixes: 10237c7bcb (LF-824: fw: imx: scu: Add missing APIs)
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
This commit is contained in:
Franck LENORMAND 2020-09-09 08:29:58 +02:00
parent 02dee426f9
commit 63d6e48d13
1 changed files with 2 additions and 2 deletions

View File

@ -53,7 +53,7 @@ struct imx_sc_msg_misc_find_memreg {
u8 val;
} resp;
} data;
};
} __packed __aligned(4);
int imx_sc_rm_find_memreg(struct imx_sc_ipc *ipc, u8 *mr, u64 addr_start,
u64 addr_end)
@ -93,7 +93,7 @@ struct imx_sc_msg_misc_get_resource_owner {
u8 val;
} resp;
} data;
};
} __packed __aligned(4);
int imx_sc_rm_get_resource_owner(struct imx_sc_ipc *ipc, u16 resource, u8 *pt)
{