Quoting Niklas Cassel (2018-04-09 14:40:15) > qcom_scm_call_atomic1() can crash with a NULL pointer dereference at > qcom_scm_call_atomic1+0x30/0x48. > > disassembly of qcom_scm_call_atomic1(): > ... > <0xc08d73b0 <+12>: ldr r3, [r12] > ... (no instruction explicitly modifies r12) > 0xc08d73cc <+40>: smc 0 > ... (no instruction explicitly modifies r12) > 0xc08d73d4 <+48>: ldr r3, [r12] <- crashing instruction > ... > > Since the first ldr is successful, and since r12 isn't explicitly > modified by any instruction between the first and the second ldr, > it must have been modified by the smc call, which is ok, > since r12 is caller save according to the AAPCS. > > Add r12 to the clobber list so that the compiler knows that the > callee potentially overwrites the value in r12. > Clobber descriptions may not in any way overlap with an input or > output operand. > > Signed-off-by: Niklas Cassel <niklas.cassel@xxxxxxxxxx> > --- Reviewed-by: Stephen Boyd <sboyd@xxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-arm-msm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
