[Skiboot] [PATCH] flash: Handle nullptr dereference of system_flash
Aditya Gupta
adityag at linux.ibm.com
Fri Mar 7 16:31:02 AEDT 2025
With QEMU with NO support for MPIPL, 'p9_sbe_terminate' returns early
at:
/* Return if MPIPL is not supported */
if (!is_mpipl_enabled())
return;
But with MPIPL supported in QEMU, 'p9_sbe_terminate' continues further and
calls 'flash_unregister' which causes a Machine Check due to nullptr
dereference of 'system_flash':
[ 13.240783728,5] Reboot: OS reported error. Performing MPIPL
[ 13.241662601,5] DUMP: Crashing PIR = 0x0
[ 13.244049276,5] RESET: Fast reboot disabled: Kernel re-entered OPAL
[ 1.815018] Disabling lock debugging due to kernel taint
[ 1.815518] MCE: CPU0: machine check (Severe) Real address Load (bad) DAR: 0000006000000098 [Not recovered]
[ 1.815544] MCE: CPU0: NIP: [0000000030040f54] 0x30040f54
[ 1.815911] MCE: CPU0: Initiator CPU
[ 1.815930] MCE: CPU0: Hardware error
[ 1.816110] opal: Hardware platform error: Unrecoverable Machine Check exception
[ 1.816338] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G M 6.12.0-rc4+ #1
[ 1.816531] Tainted: [M]=MACHINE_CHECK
[ 1.816546] Hardware name: IBM PowerNV (emulated by qemu) POWER10 0x801200 opal:v7.1 PowerNV
[ 1.816629] NIP: 0000000030040f54 LR: 000000003007e528 CTR: 000000003004d75c
[ 1.816646] REGS: c0000004d5e47d60 TRAP: 0200 Tainted: G M (6.12.0-rc4+)
[ 1.816684] MSR: 9000000002a03002 <SF,HV,VEC,VSX,FP,ME,RI> CR: 28002284 XER: 00000000
[ 1.816863] CFAR: 000000003007e524 DAR: 0000006000000098 DSISR: 00000040 IRQMASK: 3
[ 1.816863] GPR00: 000000003007e528 0000000031c13ac0 0000000030192900 0000006000000060
[ 1.816863] GPR04: 0000000030500028 000000000000000a 0000000031c10068 0000000031c10068
[ 1.816863] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ 1.816863] GPR12: 0000000028002284 c000000002e80000 c00000000001192c 0000000000000000
[ 1.816863] GPR16: 0000000031c10000 0000000000000000 0000000000000000 0000000000000000
[ 1.816863] GPR20: 0000000000000003 0000000000000074 0000000000000000 0000000000000000
[ 1.816863] GPR24: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[ 1.816863] GPR28: c000000002d0e8c8 00000000301257de c000000002d0e8c8 000000000000000c
[ 1.817061] NIP [0000000030040f54] 0x30040f54
[ 1.817074] LR [000000003007e528] 0x3007e528
[ 1.817165] Call Trace:
[ 1.817337] Code: 00000060 80002138 e01d0d48 00000000 01000000 00000180 a602087c 3700223d 602e29e9 100001f8 91ff21f8 180069e8 <380023e9> 0000292c 34008241 280041f8
[ 13.247702490,0] OPAL: Reboot requested due to Platform error.
[ 13.247857686,3] OPAL: failed to log an error
[ 13.248012502,2] NVRAM: Failed to load
Previously above machine check was never hit as QEMU platform didn't
had MPIPL, and hence the caller 'p9_sbe_terminate' used to return early.
Add null check to ignore the unregister request if system_flash is not set.
Signed-off-by: Aditya Gupta <adityag at linux.ibm.com>
---
Initial QEMU MPIPL support was posted to [1]. It has not been merged
yet.
[1]: https://lore.kernel.org/qemu-devel/20250217071934.86131-1-adityag@linux.ibm.com/
Changelog
==========
rfc -> v1:
+ reword warning message to say system flash not registered
---
---
core/flash.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/core/flash.c b/core/flash.c
index a14bfc68fd1a..6d9aeb1cbfda 100644
--- a/core/flash.c
+++ b/core/flash.c
@@ -88,7 +88,16 @@ void flash_release(void)
bool flash_unregister(void)
{
- struct blocklevel_device *bl = system_flash->bl;
+ struct blocklevel_device *bl;
+
+ if (!system_flash) {
+ prlog(PR_WARNING, "System Flash is not registered, ignoring"\
+ " unregister request\n");
+
+ return true;
+ }
+
+ bl = system_flash->bl;
if (bl->exit)
return bl->exit(bl);
--
2.48.1
More information about the Skiboot
mailing list