Skip to content

Commit e98386d

Browse files
Sagi Maimonkuba-moo
authored andcommitted
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
On Adva boards, SMA sysfs store/get operations can call __handle_signal_outputs() or __handle_signal_inputs() while the `irig` and `dcf` pointers are uninitialized, leading to a NULL pointer dereference in __handle_signal() and causing a kernel crash. Adva boards don't use `irig` or `dcf` functionality, so add Adva-specific callbacks `ptp_ocp_sma_adva_set_outputs()` and `ptp_ocp_sma_adva_set_inputs()` that avoid invoking `irig` or `dcf` input/output routines. Fixes: ef61f55 ("ptp: ocp: add Adva timecard support") Signed-off-by: Sagi Maimon <maimon.sagi@gmail.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20250429073320.33277-1-maimon.sagi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent f920436 commit e98386d

File tree

1 file changed

+50
-2
lines changed

1 file changed

+50
-2
lines changed

drivers/ptp/ptp_ocp.c

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2578,12 +2578,60 @@ static const struct ocp_sma_op ocp_fb_sma_op = {
25782578
.set_output = ptp_ocp_sma_fb_set_output,
25792579
};
25802580

2581+
static int
2582+
ptp_ocp_sma_adva_set_output(struct ptp_ocp *bp, int sma_nr, u32 val)
2583+
{
2584+
u32 reg, mask, shift;
2585+
unsigned long flags;
2586+
u32 __iomem *gpio;
2587+
2588+
gpio = sma_nr > 2 ? &bp->sma_map1->gpio2 : &bp->sma_map2->gpio2;
2589+
shift = sma_nr & 1 ? 0 : 16;
2590+
2591+
mask = 0xffff << (16 - shift);
2592+
2593+
spin_lock_irqsave(&bp->lock, flags);
2594+
2595+
reg = ioread32(gpio);
2596+
reg = (reg & mask) | (val << shift);
2597+
2598+
iowrite32(reg, gpio);
2599+
2600+
spin_unlock_irqrestore(&bp->lock, flags);
2601+
2602+
return 0;
2603+
}
2604+
2605+
static int
2606+
ptp_ocp_sma_adva_set_inputs(struct ptp_ocp *bp, int sma_nr, u32 val)
2607+
{
2608+
u32 reg, mask, shift;
2609+
unsigned long flags;
2610+
u32 __iomem *gpio;
2611+
2612+
gpio = sma_nr > 2 ? &bp->sma_map2->gpio1 : &bp->sma_map1->gpio1;
2613+
shift = sma_nr & 1 ? 0 : 16;
2614+
2615+
mask = 0xffff << (16 - shift);
2616+
2617+
spin_lock_irqsave(&bp->lock, flags);
2618+
2619+
reg = ioread32(gpio);
2620+
reg = (reg & mask) | (val << shift);
2621+
2622+
iowrite32(reg, gpio);
2623+
2624+
spin_unlock_irqrestore(&bp->lock, flags);
2625+
2626+
return 0;
2627+
}
2628+
25812629
static const struct ocp_sma_op ocp_adva_sma_op = {
25822630
.tbl = { ptp_ocp_adva_sma_in, ptp_ocp_adva_sma_out },
25832631
.init = ptp_ocp_sma_fb_init,
25842632
.get = ptp_ocp_sma_fb_get,
2585-
.set_inputs = ptp_ocp_sma_fb_set_inputs,
2586-
.set_output = ptp_ocp_sma_fb_set_output,
2633+
.set_inputs = ptp_ocp_sma_adva_set_inputs,
2634+
.set_output = ptp_ocp_sma_adva_set_output,
25872635
};
25882636

25892637
static int

0 commit comments

Comments
 (0)