From: Roja Rani Yarubandi <rojay@codeaurora.org>
To: broonie@kernel.org
Cc: agross@kernel.org, bjorn.andersson@linaro.org,
swboyd@chromium.org, dianders@chromium.org,
linux-arm-msm@vger.kernel.org, linux-spi@vger.kernel.org,
linux-kernel@vger.kernel.org, akashast@codeaurora.org,
msavaliy@qti.qualcomm.com,
Roja Rani Yarubandi <rojay@codeaurora.org>
Subject: [PATCH] spi: spi-geni-qcom: Fix NULL pointer access in geni_spi_isr
Date: Thu, 3 Dec 2020 13:14:59 +0530 [thread overview]
Message-ID: <20201203074459.13078-1-rojay@codeaurora.org> (raw)
Here, there is a chance of race condition occurrence which leads to
NULL pointer dereference with struct spi_geni_master member 'cur_xfer'
between setup_fifo_xfer() and handle_fifo_timeout() functions.
Fix this race condition with guarding the 'cur_xfer' where it gets updated,
with spin_lock_irq/spin_unlock_irq in setup_fifo_xfer() as we do in
handle_fifo_timeout() function.
Call trace:
geni_spi_isr+0x114/0x34c
__handle_irq_event_percpu+0xe0/0x23c
handle_irq_event_percpu+0x34/0x8c
handle_irq_event+0x48/0x94
handle_fasteoi_irq+0xd0/0x140
__handle_domain_irq+0x8c/0xcc
gic_handle_irq+0x114/0x1dc
el1_irq+0xcc/0x180
geni_spi a80000.spi: Failed to cancel/abort m_cmd
dev_watchdog+0x348/0x354
call_timer_fn+0xc4/0x220
__run_timers+0x228/0x2d4
spi_master spi6: failed to transfer one message from queue
run_timer_softirq+0x24/0x44
__do_softirq+0x16c/0x344
irq_exit+0xa8/0xac
__handle_domain_irq+0x94/0xcc
gic_handle_irq+0x114/0x1dc
el1_irq+0xcc/0x180
cpuidle_enter_state+0xf8/0x204
cpuidle_enter+0x38/0x4c
cros-ec-spi spi6.0: spi transfer failed: -110
...
Fixes: 2ee471a1e28e ("spi: spi-geni-qcom: Mo' betta locking")
Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
---
drivers/spi/spi-geni-qcom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
index 25810a7eef10..e65d6676602b 100644
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -457,7 +457,6 @@ static void setup_fifo_xfer(struct spi_transfer *xfer,
len = xfer->len / (mas->cur_bits_per_word / BITS_PER_BYTE + 1);
len &= TRANS_LEN_MSK;
- mas->cur_xfer = xfer;
if (xfer->tx_buf) {
m_cmd |= SPI_TX_ONLY;
mas->tx_rem_bytes = xfer->len;
@@ -475,6 +474,7 @@ static void setup_fifo_xfer(struct spi_transfer *xfer,
* interrupt could come in at any time now.
*/
spin_lock_irq(&mas->lock);
+ mas->cur_xfer = xfer;
geni_se_setup_m_cmd(se, m_cmd, FRAGMENTATION);
/*
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
next reply other threads:[~2020-12-03 7:46 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-03 7:44 Roja Rani Yarubandi [this message]
2020-12-03 16:40 ` [PATCH] spi: spi-geni-qcom: Fix NULL pointer access in geni_spi_isr Doug Anderson
2020-12-10 3:17 ` Stephen Boyd
2020-12-10 17:14 ` Doug Anderson
2020-12-10 22:57 ` Stephen Boyd
2020-12-10 23:07 ` Doug Anderson
2020-12-10 23:32 ` Stephen Boyd
2020-12-10 23:50 ` Doug Anderson
2020-12-11 0:50 ` Stephen Boyd
2020-12-11 1:04 ` Doug Anderson
2020-12-11 1:21 ` Stephen Boyd
2020-12-11 1:30 ` Doug Anderson
2020-12-11 1:39 ` Stephen Boyd
2020-12-11 1:51 ` Doug Anderson
2020-12-12 1:32 ` Stephen Boyd
2020-12-15 0:31 ` Doug Anderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201203074459.13078-1-rojay@codeaurora.org \
--to=rojay@codeaurora.org \
--cc=agross@kernel.org \
--cc=akashast@codeaurora.org \
--cc=bjorn.andersson@linaro.org \
--cc=broonie@kernel.org \
--cc=dianders@chromium.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=msavaliy@qti.qualcomm.com \
--cc=swboyd@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).