This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM625: Poweroff will cause NULL-pointer dereference in case the optional wakeup pinctrl state is not configured

Part Number: AM625
Other Parts Discussed in Thread: ADS1015, TPS65219

Tool/software:

Hi,

The wakeup pinctrl state is optional for m_can driver. When not configuring the following error appears on poweroff:

```

[  672.684949] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
[  672.693766] Mem abort info:
[  672.696551]   ESR = 0x0000000096000004
[  672.700297]   EC = 0x25: DABT (current EL), IL = 32 bits
[  672.705603]   SET = 0, FnV = 0
[  672.708649]   EA = 0, S1PTW = 0
[  672.711786]   FSC = 0x04: level 0 translation fault
[  672.716659] Data abort info:
[  672.719534]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  672.725012]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  672.730056]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  672.735362] user pgtable: 4k pages, 48-bit VAs, pgdp=000000008462f000
[  672.741799] [0000000000000018] pgd=0000000000000000, p4d=0000000000000000
[  672.748590] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  672.754844] Modules linked in: af_alg brcmfmac_cyw irq_pruss_intc pru_rproc brcmfmac brcmutil hci_uart cfg80211 btqca btbcm pwrseq_core bluetooth crct10dif_ce ecdh_generic ecc rfkill rtc_ti_k3 rti_wdt pruss omap_hw
spinlock omap_mailbox sa2ul mcrc64 tps65219_pwrbutton rtc_pcf8563 ti_ads1015 lm75 at24 industrialio_triggered_buffer kfifo_buf ti_eqep counter m_can_platform m_can spi_omap2_mcspi can_dev ramoops pwm_tiehrpwm reed_sol
omon drm drm_panel_orientation_quirks backlight fuse ipv6
[  672.797744] CPU: 1 UID: 0 PID: 1 Comm: systemd-shutdow Not tainted 6.12.17-ti-00771-gc85877d40f8e-dirty #1
[  672.807379] Hardware name: SYSTEC sysWORXX CTR-800 (DT)
[  672.812591] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  672.819539] pc : pinctrl_commit_state+0x68/0x20c
[  672.824161] lr : pinctrl_commit_state+0x54/0x20c
[  672.828769] sp : ffff8000822abba0
[  672.832071] x29: ffff8000822abba0 x28: ffff000000508000 x27: 0000000000000000
[  672.839199] x26: 0000000000000000 x25: 0000000000000000 x24: ffff8000820ad630
[  672.846326] x23: ffff000008102140 x22: ffff0000083ee0c0 x21: 0000000000000000
[  672.853452] x20: ffff000008102158 x19: ffff000008102158 x18: 0000000000000001
[  672.860579] x17: 0000000000000000 x16: 0000000000000000 x15: ffff000037dba240
[  672.867705] x14: 0000000000000001 x13: ffff000000508080 x12: 0000000000000001
[  672.874832] x11: 0000000000000040 x10: ffff000000708860 x9 : ffff000000708858
[  672.881959] x8 : ffff0000008bcdd8 x7 : 0000000000000000 x6 : 0000000000000000
[  672.889085] x5 : ffff0000008bcdb0 x4 : 0000000000000000 x3 : 0000000000000000
[  672.896211] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000000508000
[  672.903339] Call trace:
[  672.905776]  pinctrl_commit_state+0x68/0x20c
[  672.910039]  pinctrl_select_state+0x1c/0x30
[  672.914215]  m_can_class_sysoff_handler+0x3c/0x78 [m_can]
[  672.919614]  sys_off_notify+0x40/0x6c
[  672.923272]  blocking_notifier_call_chain+0x6c/0xa0
[  672.928140]  kernel_power_off+0x50/0x80
[  672.931968]  __do_sys_reboot+0x210/0x270
[  672.935882]  __arm64_sys_reboot+0x24/0x30
[  672.939883]  invoke_syscall+0x48/0x10c
[  672.943627]  el0_svc_common.constprop.0+0x40/0xe0
[  672.948323]  do_el0_svc+0x1c/0x28
[  672.951631]  el0_svc+0x28/0x98
[  672.954682]  el0t_64_sync_handler+0x120/0x12c
[  672.959030]  el0t_64_sync+0x190/0x194
[  672.962690] Code: eb14027f 54ffff21 aa1903f5 f90016df (f8418eb4)
[  672.968768] ---[ end trace 0000000000000000 ]---
[  672.980619] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[  672.988292] Kernel Offset: disabled
[  672.991770] CPU features: 0x00,00000080,00200000,4200420b
[  672.997158] Memory Limit: none
[  673.007059] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

```

The error first appeared after updating to SDK version 11.00.09.04. (with Kernel 6.12)

To me it seems that the following commit introduces this issue:

git.ti.com/.../

I think the check of `!IS_ERR(cdev->pinctrl_state_wakeup)` is the cause. Shouldn't this be a simple null-pointer check?

Can you confirm this issue?

Regards