[PATCH] spmi: spmi-pmic-arb: Fix hw_irq overflow

[PATCH] spmi: spmi-pmic-arb: Fix hw_irq overflow

[Subbaraman Narayanamurthy]

Currently, when handling the SPMI summary interrupt, the hw_irq
number is calculated based on SID, Peripheral ID, IRQ index and
APID. This is then passed to irq_find_mapping() to see if a
mapping exists for this hw_irq and if available, invoke the
interrupt handler. Since the IRQ index uses an "int" type, hw_irq
which is of unsigned long data type can take a large value when
SID has its MSB set to 1 and the type conversion happens. Because
of this, irq_find_mapping() returns 0 as there is no mapping
for this hw_irq. This ends up invoking cleanup_irq() as if
the interrupt is spurious whereas it is actually a valid
interrupt. Fix this by using the proper data type (u32) for id.

Cc: stable@vger.kernel.org
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
---
 drivers/spmi/spmi-pmic-arb.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index de844b4..bbbd311 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2015, 2017, 2021, The Linux Foundation. All rights reserved.
  */
 #include <linux/bitmap.h>
 #include <linux/delay.h>
@@ -505,8 +505,7 @@ static void cleanup_irq(struct spmi_pmic_arb *pmic_arb, u16 apid, int id)
 static void periph_interrupt(struct spmi_pmic_arb *pmic_arb, u16 apid)
 {
 	unsigned int irq;
-	u32 status;
-	int id;
+	u32 status, id;
 	u8 sid = (pmic_arb->apid_data[apid].ppid >> 8) & 0xF;
 	u8 per = pmic_arb->apid_data[apid].ppid & 0xFF;
 
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project

Re: [PATCH] spmi: spmi-pmic-arb: Fix hw_irq overflow

[Stephen Boyd]

Quoting Subbaraman Narayanamurthy (2021-02-08 11:33:04)
> Currently, when handling the SPMI summary interrupt, the hw_irq
> number is calculated based on SID, Peripheral ID, IRQ index and
> APID. This is then passed to irq_find_mapping() to see if a
> mapping exists for this hw_irq and if available, invoke the
> interrupt handler. Since the IRQ index uses an "int" type, hw_irq
> which is of unsigned long data type can take a large value when
> SID has its MSB set to 1 and the type conversion happens. Because
> of this, irq_find_mapping() returns 0 as there is no mapping
> for this hw_irq. This ends up invoking cleanup_irq() as if
> the interrupt is spurious whereas it is actually a valid
> interrupt. Fix this by using the proper data type (u32) for id.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
> ---

Applied to spmi-next

Re: [PATCH] spmi: spmi-pmic-arb: Fix hw_irq overflow

[patchwork-bot+linux-arm-msm]

Hello:

This patch was applied to qcom/linux.git (refs/heads/for-next):

On Mon,  8 Feb 2021 11:33:04 -0800 you wrote:
> Currently, when handling the SPMI summary interrupt, the hw_irq
> number is calculated based on SID, Peripheral ID, IRQ index and
> APID. This is then passed to irq_find_mapping() to see if a
> mapping exists for this hw_irq and if available, invoke the
> interrupt handler. Since the IRQ index uses an "int" type, hw_irq
> which is of unsigned long data type can take a large value when
> SID has its MSB set to 1 and the type conversion happens. Because
> of this, irq_find_mapping() returns 0 as there is no mapping
> for this hw_irq. This ends up invoking cleanup_irq() as if
> the interrupt is spurious whereas it is actually a valid
> interrupt. Fix this by using the proper data type (u32) for id.
> 
> [...]

Here is the summary with links:
  - spmi: spmi-pmic-arb: Fix hw_irq overflow
    https://git.kernel.org/qcom/c/d19db80a3665

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH] spmi: spmi-pmic-arb: Fix hw_irq overflow

[Subbaraman Narayanamurthy]

Currently, when handling the SPMI summary interrupt, the hw_irq
number is calculated based on SID, Peripheral ID, IRQ index and
APID. This is then passed to irq_find_mapping() to see if a
mapping exists for this hw_irq and if available, invoke the
interrupt handler. Since the IRQ index uses an "int" type, hw_irq
which is of unsigned long data type can take a large value when
SID has its MSB set to 1 and the type conversion happens. Because
of this, irq_find_mapping() returns 0 as there is no mapping
for this hw_irq. This ends up invoking cleanup_irq() as if
the interrupt is spurious whereas it is actually a valid
interrupt. Fix this by using the proper data type (u32) for id.

Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
---
 drivers/spmi/spmi-pmic-arb.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index de844b4..bbbd311 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2015, 2017, 2021, The Linux Foundation. All rights reserved.
  */
 #include <linux/bitmap.h>
 #include <linux/delay.h>
@@ -505,8 +505,7 @@ static void cleanup_irq(struct spmi_pmic_arb *pmic_arb, u16 apid, int id)
 static void periph_interrupt(struct spmi_pmic_arb *pmic_arb, u16 apid)
 {
 	unsigned int irq;
-	u32 status;
-	int id;
+	u32 status, id;
 	u8 sid = (pmic_arb->apid_data[apid].ppid >> 8) & 0xF;
 	u8 per = pmic_arb->apid_data[apid].ppid & 0xFF;
 
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project