[PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Krzysztof Kozlowski]

Unprepare and drop the SMC clock reference, if probe fails to avoid
resource leakage e.g. during probe deferral.

There is no remove() callback, presumably on purpose so only error paths
are handled.

Cc: <stable@vger.kernel.org>
Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/all/20260917101623.2146392-1-vulab@iscas.ac.cn/
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-8e236c81-01b2-4274-a213-11c3f31acfc2
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

---

I independently developed the patch and then checked the queue with
pending work of iscas. That one has issues and other complains from me,
so only credits for the report.

Changes in v2:
1. Handle of_platform_populate() error.
---
 drivers/memory/atmel-ebi.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 1e8e8aba2542..7dc2f7add1b1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -562,7 +562,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 	}
 	ret = clk_prepare_enable(ebi->smc.clk);
 	if (ret)
-		return ret;
+		goto err_put_clk;
 
 	/*
 	 * The sama5d3 does not provide an EBICSA register and thus does need
@@ -572,14 +572,16 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 		ebi->regmap =
 			syscon_regmap_lookup_by_phandle(np,
 							ebi->caps->regmap_name);
-		if (IS_ERR(ebi->regmap))
-			return PTR_ERR(ebi->regmap);
+		if (IS_ERR(ebi->regmap)) {
+			ret = PTR_ERR(ebi->regmap);
+			goto err_disable_clk;
+		}
 	}
 
 	ret = of_property_read_u32(np, "#address-cells", &val);
 	if (ret) {
 		dev_err(dev, "missing #address-cells property\n");
-		return ret;
+		goto err_disable_clk;
 	}
 
 	reg_cells = val;
@@ -587,7 +589,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 	ret = of_property_read_u32(np, "#size-cells", &val);
 	if (ret) {
 		dev_err(dev, "missing #address-cells property\n");
-		return ret;
+		goto err_disable_clk;
 	}
 
 	reg_cells += val;
@@ -603,11 +605,22 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 
 			ret = atmel_ebi_dev_disable(ebi, child);
 			if (ret)
-				return ret;
+				goto err_disable_clk;
 		}
 	}
 
-	return of_platform_populate(np, NULL, NULL, dev);
+	ret = of_platform_populate(np, NULL, NULL, dev);
+	if (ret)
+		goto err_disable_clk;
+
+	return 0;
+
+err_disable_clk:
+	clk_disable_unprepare(ebi->smc.clk);
+err_put_clk:
+	clk_put(ebi->smc.clk);
+
+	return ret;
 }
 
 static __maybe_unused int atmel_ebi_resume(struct device *dev)
-- 
2.53.0

[PATCH v2] soc: qcom: apr: Reject packets with header size larger than packet size

[Krzysztof Kozlowski]

apr_do_rx_callback() and gpr_do_rx_callback() validate the header size
and the packet size separately, but never check that the header fits
within the packet.  Both sizes are u16, so with a malformed packet where
the header size exceeds the packet size, the subtraction computing
resp.payload_size gets promoted to int and becomes negative.

Further check "resp.payload_size > 0" would fail, leading to
resp.payload left uninitialized (stack value).  Reject such packets as
having a wrong packet size, although unlikely that firmware would
produce such packets.

Fixes: 6adba21eb434 ("soc: qcom: Add APR bus driver")
Fixes: ec1471a898cc ("soc: qcom: apr: Add GPR support")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-82d40745-1593-4c20-8432-d86099836525
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

---

Changes in v2:
1. Test for <=, because hdr==pkt size still would leave the response
   payload uninitialized.
---
 drivers/soc/qcom/apr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
index 2d5645ff9919..e303562526d4 100644
--- a/drivers/soc/qcom/apr.c
+++ b/drivers/soc/qcom/apr.c
@@ -210,7 +210,8 @@ static int apr_do_rx_callback(struct packet_router *apr, struct apr_rx_buf *abuf
 		return -EINVAL;
 	}
 
-	if (hdr->pkt_size < APR_HDR_SIZE || hdr->pkt_size != len) {
+	if (hdr->pkt_size < APR_HDR_SIZE || hdr->pkt_size != len ||
+	    hdr->pkt_size <= hdr_size) {
 		dev_err(apr->dev, "APR: Wrong packet size\n");
 		return -EINVAL;
 	}
@@ -280,7 +281,8 @@ static int gpr_do_rx_callback(struct packet_router *gpr, struct apr_rx_buf *abuf
 		return -EINVAL;
 	}
 
-	if (hdr->pkt_size < GPR_PKT_HEADER_BYTE_SIZE || hdr->pkt_size != len) {
+	if (hdr->pkt_size < GPR_PKT_HEADER_BYTE_SIZE || hdr->pkt_size != len ||
+	    hdr->pkt_size <= hdr_size * 4) {
 		dev_err(gpr->dev, "GPR: Wrong packet size\n");
 		return -EINVAL;
 	}
-- 
2.53.0

Re: [PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Alexandre Belloni]

Hi,

On 01/11/2026 20:07:34+0100, Krzysztof Kozlowski wrote:
> Unprepare and drop the SMC clock reference, if probe fails to avoid
> resource leakage e.g. during probe deferral.
> 
> There is no remove() callback, presumably on purpose so only error paths
> are handled.
> 
> Cc: <stable@vger.kernel.org>
> Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified")
> Reported-by: Wentao Liang <vulab@iscas.ac.cn>
> Closes: https://lore.kernel.org/all/20260917101623.2146392-1-vulab@iscas.ac.cn/
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-8e236c81-01b2-4274-a213-11c3f31acfc2
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> 
> ---
> 
> I independently developed the patch and then checked the queue with
> pending work of iscas. That one has issues and other complains from me,
> so only credits for the report.
> 
> Changes in v2:
> 1. Handle of_platform_populate() error.
> ---
>  drivers/memory/atmel-ebi.c | 27 ++++++++++++++++++++-------
>  1 file changed, 20 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
> index 1e8e8aba2542..7dc2f7add1b1 100644
> --- a/drivers/memory/atmel-ebi.c
> +++ b/drivers/memory/atmel-ebi.c
> @@ -562,7 +562,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
>  	}
>  	ret = clk_prepare_enable(ebi->smc.clk);
>  	if (ret)
> -		return ret;
> +		goto err_put_clk;
>  

Couldn't we simply devm_clk_get_enabled() ?

>  	/*
>  	 * The sama5d3 does not provide an EBICSA register and thus does need
> @@ -572,14 +572,16 @@ static int atmel_ebi_probe(struct platform_device *pdev)
>  		ebi->regmap =
>  			syscon_regmap_lookup_by_phandle(np,
>  							ebi->caps->regmap_name);
> -		if (IS_ERR(ebi->regmap))
> -			return PTR_ERR(ebi->regmap);
> +		if (IS_ERR(ebi->regmap)) {
> +			ret = PTR_ERR(ebi->regmap);
> +			goto err_disable_clk;
> +		}
>  	}
>  
>  	ret = of_property_read_u32(np, "#address-cells", &val);
>  	if (ret) {
>  		dev_err(dev, "missing #address-cells property\n");
> -		return ret;
> +		goto err_disable_clk;
>  	}
>  
>  	reg_cells = val;
> @@ -587,7 +589,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
>  	ret = of_property_read_u32(np, "#size-cells", &val);
>  	if (ret) {
>  		dev_err(dev, "missing #address-cells property\n");
> -		return ret;
> +		goto err_disable_clk;
>  	}
>  
>  	reg_cells += val;
> @@ -603,11 +605,22 @@ static int atmel_ebi_probe(struct platform_device *pdev)
>  
>  			ret = atmel_ebi_dev_disable(ebi, child);
>  			if (ret)
> -				return ret;
> +				goto err_disable_clk;
>  		}
>  	}
>  
> -	return of_platform_populate(np, NULL, NULL, dev);
> +	ret = of_platform_populate(np, NULL, NULL, dev);
> +	if (ret)
> +		goto err_disable_clk;
> +
> +	return 0;
> +
> +err_disable_clk:
> +	clk_disable_unprepare(ebi->smc.clk);
> +err_put_clk:
> +	clk_put(ebi->smc.clk);
> +
> +	return ret;
>  }
>  
>  static __maybe_unused int atmel_ebi_resume(struct device *dev)
> -- 
> 2.53.0
> 

-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Krzysztof Kozlowski]

On 04/11/2026 19:53, Alexandre Belloni wrote:
> Hi,
> 
> On 01/11/2026 20:07:34+0100, Krzysztof Kozlowski wrote:
>> Unprepare and drop the SMC clock reference, if probe fails to avoid
>> resource leakage e.g. during probe deferral.
>>
>> There is no remove() callback, presumably on purpose so only error paths
>> are handled.
>>
>> Cc: <stable@vger.kernel.org>
>> Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified")
>> Reported-by: Wentao Liang <vulab@iscas.ac.cn>
>> Closes: https://lore.kernel.org/all/20260917101623.2146392-1-vulab@iscas.ac.cn/
>> Reported-by: Sashiko <sashiko-bot@kernel.org>
>> Closes: https://sashiko.dev/#/bug/linux-8e236c81-01b2-4274-a213-11c3f31acfc2
>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
>>
>> ---
>>
>> I independently developed the patch and then checked the queue with
>> pending work of iscas. That one has issues and other complains from me,
>> so only credits for the report.
>>
>> Changes in v2:
>> 1. Handle of_platform_populate() error.
>> ---
>>  drivers/memory/atmel-ebi.c | 27 ++++++++++++++++++++-------
>>  1 file changed, 20 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
>> index 1e8e8aba2542..7dc2f7add1b1 100644
>> --- a/drivers/memory/atmel-ebi.c
>> +++ b/drivers/memory/atmel-ebi.c
>> @@ -562,7 +562,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
>>  	}
>>  	ret = clk_prepare_enable(ebi->smc.clk);
>>  	if (ret)
>> -		return ret;
>> +		goto err_put_clk;
>>  
> 
> Couldn't we simply devm_clk_get_enabled() ?
It is not this device's clock. Is there devm_clk_get_enabled() variant
which takes from other node?

Best regards,
Krzysztof

Re: [PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Alexandre Belloni]

On 04/11/2026 19:59:45+0100, Krzysztof Kozlowski wrote:
> On 04/11/2026 19:53, Alexandre Belloni wrote:
> > Hi,
> > 
> > On 01/11/2026 20:07:34+0100, Krzysztof Kozlowski wrote:
> >> Unprepare and drop the SMC clock reference, if probe fails to avoid
> >> resource leakage e.g. during probe deferral.
> >>
> >> There is no remove() callback, presumably on purpose so only error paths
> >> are handled.
> >>
> >> Cc: <stable@vger.kernel.org>
> >> Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified")
> >> Reported-by: Wentao Liang <vulab@iscas.ac.cn>
> >> Closes: https://lore.kernel.org/all/20260917101623.2146392-1-vulab@iscas.ac.cn/
> >> Reported-by: Sashiko <sashiko-bot@kernel.org>
> >> Closes: https://sashiko.dev/#/bug/linux-8e236c81-01b2-4274-a213-11c3f31acfc2
> >> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> >>
> >> ---
> >>
> >> I independently developed the patch and then checked the queue with
> >> pending work of iscas. That one has issues and other complains from me,
> >> so only credits for the report.
> >>
> >> Changes in v2:
> >> 1. Handle of_platform_populate() error.
> >> ---
> >>  drivers/memory/atmel-ebi.c | 27 ++++++++++++++++++++-------
> >>  1 file changed, 20 insertions(+), 7 deletions(-)
> >>
> >> diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
> >> index 1e8e8aba2542..7dc2f7add1b1 100644
> >> --- a/drivers/memory/atmel-ebi.c
> >> +++ b/drivers/memory/atmel-ebi.c
> >> @@ -562,7 +562,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
> >>  	}
> >>  	ret = clk_prepare_enable(ebi->smc.clk);
> >>  	if (ret)
> >> -		return ret;
> >> +		goto err_put_clk;
> >>  
> > 
> > Couldn't we simply devm_clk_get_enabled() ?
> It is not this device's clock. Is there devm_clk_get_enabled() variant
> which takes from other node?

Right! Not that I know of.

Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>


> 
> Best regards,
> Krzysztof

-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Krzysztof Kozlowski]

On Fri, 30 Oct 2026 16:24:06 +0100, Krzysztof Kozlowski wrote:
> Unprepare and drop the SMC clock reference, if probe fails to avoid
> resource leakage e.g. during probe deferral.
> 
> There is no remove() callback, presumably on purpose so only error paths
> are handled.
> 
> 
> [...]

Applied, thanks!

[1/1] memory: atmel-ebi: Disable SMC clock on probe failure
      https://git.kernel.org/krzk/linux-mem-ctrl/c/3bbb9a75ec35e77907b990ae163b596e8e67fb46

Best regards,
-- 
Krzysztof Kozlowski <krzk@kernel.org>

[PATCH v2] memory: atmel-ebi: Disable SMC clock on probe failure

[Krzysztof Kozlowski]

Unprepare and drop the SMC clock reference, if probe fails to avoid
resource leakage e.g. during probe deferral.

There is no remove() callback, presumably on purpose so only error paths
are handled.

Cc: <stable@vger.kernel.org>
Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/all/20260917101623.2146392-1-vulab@iscas.ac.cn/
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-8e236c81-01b2-4274-a213-11c3f31acfc2
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

---

I independently developed the patch and then checked the queue with
pending work of iscas. That one has issues and other complains from me,
so only credits for the report.

Changes in v2:
1. Handle of_platform_populate() error.
---
 drivers/memory/atmel-ebi.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 1e8e8aba2542..7dc2f7add1b1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -562,7 +562,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 	}
 	ret = clk_prepare_enable(ebi->smc.clk);
 	if (ret)
-		return ret;
+		goto err_put_clk;
 
 	/*
 	 * The sama5d3 does not provide an EBICSA register and thus does need
@@ -572,14 +572,16 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 		ebi->regmap =
 			syscon_regmap_lookup_by_phandle(np,
 							ebi->caps->regmap_name);
-		if (IS_ERR(ebi->regmap))
-			return PTR_ERR(ebi->regmap);
+		if (IS_ERR(ebi->regmap)) {
+			ret = PTR_ERR(ebi->regmap);
+			goto err_disable_clk;
+		}
 	}
 
 	ret = of_property_read_u32(np, "#address-cells", &val);
 	if (ret) {
 		dev_err(dev, "missing #address-cells property\n");
-		return ret;
+		goto err_disable_clk;
 	}
 
 	reg_cells = val;
@@ -587,7 +589,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 	ret = of_property_read_u32(np, "#size-cells", &val);
 	if (ret) {
 		dev_err(dev, "missing #address-cells property\n");
-		return ret;
+		goto err_disable_clk;
 	}
 
 	reg_cells += val;
@@ -603,11 +605,22 @@ static int atmel_ebi_probe(struct platform_device *pdev)
 
 			ret = atmel_ebi_dev_disable(ebi, child);
 			if (ret)
-				return ret;
+				goto err_disable_clk;
 		}
 	}
 
-	return of_platform_populate(np, NULL, NULL, dev);
+	ret = of_platform_populate(np, NULL, NULL, dev);
+	if (ret)
+		goto err_disable_clk;
+
+	return 0;
+
+err_disable_clk:
+	clk_disable_unprepare(ebi->smc.clk);
+err_put_clk:
+	clk_put(ebi->smc.clk);
+
+	return ret;
 }
 
 static __maybe_unused int atmel_ebi_resume(struct device *dev)
-- 
2.53.0