[Skiboot] [PATCH v2] hdata: Prevent NULL dereference on duplicate entries in TMPREL section

Mahesh Salgaonkar mahesh at linux.ibm.com
Tue Mar 25 03:24:03 AEDT 2025


Currently if you encounter duplicate entries in TMPREL section while
parsing HDAT, opal crashes with bellow back trace:

[  119.205498180,3] DT: dt_attach_root failed, duplicate ibm,cvc-service at 40
[  119.206975658,3] ***********************************************
[  119.208669044,3] Fatal MCE at 000000003003729c
.dt_find_property+0x30  MSR 9000000000001002
[  119.210355268,3] Cause: unknown error
[  119.211273270,3] CFAR : 0000000030037288 MSR  : 9000000000001002
[  119.212502638,3] SRR0 : 000000003003729c SRR1 : 9000000000001002
[  119.214037362,3] HSRR0: 0000000030020024 HSRR1: 9000000000001000
[  119.215266730,3] DSISR: 40000000         DAR  : a600607d01006b79
[...]
CPU 0008 Backtrace:
 S: 0000000031c53980 R: 0000000030026b0c   .__memalign+0x58
 S: 0000000031c53a10 R: 0000000030037378   .new_property+0xb0
 S: 0000000031c53aa0 R: 0000000030037778   .__dt_add_property_strings+0x58
 S: 0000000031c53b40 R: 000000003010bf74   .node_stb_parse+0x414
 S: 0000000031c53c30 R: 0000000030102ee4   .parse_hdat+0x20cc
 S: 0000000031c53e30 R: 0000000030022c04   .main_cpu_entry+0x1d0
 S: 0000000031c53f00 R: 000000003000321c   go_primary+0x10c
 --- OPAL boot ---

fix the null pointer deref and proceed with warning message instead of
crashing. Also add debug prints to display all entries.

Signed-off-by: Mahesh Salgaonkar <mahesh at linux.ibm.com>
---
Change in v2:
- Use be32_to_cpu(hv->dbob_id) in print instead of using extra variable.
- See v1 at https://lists.ozlabs.org/pipermail/skiboot/2025-March/019154.html
---
 hdata/tpmrel.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hdata/tpmrel.c b/hdata/tpmrel.c
index c70791839..2a75acd26 100644
--- a/hdata/tpmrel.c
+++ b/hdata/tpmrel.c
@@ -190,6 +190,8 @@ static void tpmrel_cvc_init(struct HDIF_common_hdr *hdif_hdr)
 		type = be32_to_cpu(hv->type);
 		offset = be32_to_cpu(hv->offset);
 		version = be32_to_cpu(hv->version);
+		prlog(PR_DEBUG, "entry %d: type=0x%x, version=0x%x, dbob_id=0x%x, offset=0x%x\n",
+				i, type, version, be32_to_cpu(hv->dbob_id), offset);
 
 		compat = cvc_service_map_compat(type);
 
@@ -199,6 +201,11 @@ static void tpmrel_cvc_init(struct HDIF_common_hdr *hdif_hdr)
 		}
 
 		node = dt_new_addr(parent, "ibm,cvc-service", offset);
+		if (!node) {
+			prlog(PR_WARNING, "TPMREL: CVC service entry %d: Couldn't add DT node\n",
+			      i);
+			continue;
+		}
 		dt_add_property_strings(node, "compatible", compat);
 		dt_add_property_cells(node, "reg", offset);
 		dt_add_property_cells(node, "version", version);
-- 
2.49.0



More information about the Skiboot mailing list