| Message ID | 20210421164317.1718831-2-maz@kernel.org |
|---|---|
| State | Accepted |
| Commit | 1ecd5b129252249b9bc03d7645a7bda512747277 |
| Headers | show |
| Series | arm64: ACPI GTDT watchdog fixes | expand |
On Wed, Apr 21, 2021 at 05:43:16PM +0100, Marc Zyngier wrote: > When failing the driver probe because of invalid firmware properties, > the GTDT driver unmaps the interrupt that it mapped earlier. > > However, it never checks whether the mapping of the interrupt actially > succeeded. Even more, should the firmware report an illegal interrupt > number that overlaps with the GIC SGI range, this can result in an > IPI being unmapped, and subsequent fireworks (as reported by Dann > Frazier). > > Rework the driver to have a slightly saner behaviour and actually > check whether the interrupt has been mapped before unmapping things. > Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
(with stable email fixed, but may need separate posting anyways) On Wed, Apr 21, 2021 at 05:43:16PM +0100, Marc Zyngier wrote: > When failing the driver probe because of invalid firmware properties, > the GTDT driver unmaps the interrupt that it mapped earlier. > > However, it never checks whether the mapping of the interrupt actially > succeeded. Even more, should the firmware report an illegal interrupt > number that overlaps with the GIC SGI range, this can result in an > IPI being unmapped, and subsequent fireworks (as reported by Dann > Frazier). > > Rework the driver to have a slightly saner behaviour and actually > check whether the interrupt has been mapped before unmapping things. > > Reported-by: dann frazier <dann.frazier@canonical.com> > Fixes: ca9ae5ec4ef0 ("acpi/arm64: Add SBSA Generic Watchdog support in GTDT driver") > Signed-off-by: Marc Zyngier <maz@kernel.org> > Link: https://lore.kernel.org/r/YH87dtTfwYgavusz@xps13.dannf > Cc: stable@vgerlkernel.org ^^^ I thought I messed up while replying with my fat fingers, but here is the culprit. I got mail delivery failure to my reply, thought I will let you know as it may be difficult to notice this when using git send-email.
On Wed, 21 Apr 2021 18:20:56 +0100, Sudeep Holla <sudeep.holla@arm.com> wrote: > > (with stable email fixed, but may need separate posting anyways) > > On Wed, Apr 21, 2021 at 05:43:16PM +0100, Marc Zyngier wrote: > > When failing the driver probe because of invalid firmware properties, > > the GTDT driver unmaps the interrupt that it mapped earlier. > > > > However, it never checks whether the mapping of the interrupt actially > > succeeded. Even more, should the firmware report an illegal interrupt > > number that overlaps with the GIC SGI range, this can result in an > > IPI being unmapped, and subsequent fireworks (as reported by Dann > > Frazier). > > > > Rework the driver to have a slightly saner behaviour and actually > > check whether the interrupt has been mapped before unmapping things. > > > > Reported-by: dann frazier <dann.frazier@canonical.com> > > Fixes: ca9ae5ec4ef0 ("acpi/arm64: Add SBSA Generic Watchdog support in GTDT driver") > > Signed-off-by: Marc Zyngier <maz@kernel.org> > > Link: https://lore.kernel.org/r/YH87dtTfwYgavusz@xps13.dannf > > Cc: stable@vgerlkernel.org > ^^^ > > I thought I messed up while replying with my fat fingers, but here is the > culprit. I got mail delivery failure to my reply, thought I will let you > know as it may be difficult to notice this when using git send-email. I'm definitely the one with very fat fingers. I'll fix the patch in my tree. Thanks for the heads up, M.
diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c index f2d0e5915dab..0a0a982f9c28 100644 --- a/drivers/acpi/arm64/gtdt.c +++ b/drivers/acpi/arm64/gtdt.c @@ -329,7 +329,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, int index) { struct platform_device *pdev; - int irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags); + int irq; /* * According to SBSA specification the size of refresh and control @@ -338,7 +338,7 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, struct resource res[] = { DEFINE_RES_MEM(wd->control_frame_address, SZ_4K), DEFINE_RES_MEM(wd->refresh_frame_address, SZ_4K), - DEFINE_RES_IRQ(irq), + {}, }; int nr_res = ARRAY_SIZE(res); @@ -348,10 +348,11 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, if (!(wd->refresh_frame_address && wd->control_frame_address)) { pr_err(FW_BUG "failed to get the Watchdog base address.\n"); - acpi_unregister_gsi(wd->timer_interrupt); return -EINVAL; } + irq = map_gt_gsi(wd->timer_interrupt, wd->timer_flags); + res[2] = (struct resource)DEFINE_RES_IRQ(irq); if (irq <= 0) { pr_warn("failed to map the Watchdog interrupt.\n"); nr_res--; @@ -364,7 +365,8 @@ static int __init gtdt_import_sbsa_gwdt(struct acpi_gtdt_watchdog *wd, */ pdev = platform_device_register_simple("sbsa-gwdt", index, res, nr_res); if (IS_ERR(pdev)) { - acpi_unregister_gsi(wd->timer_interrupt); + if (irq > 0) + acpi_unregister_gsi(wd->timer_interrupt); return PTR_ERR(pdev); }
When failing the driver probe because of invalid firmware properties, the GTDT driver unmaps the interrupt that it mapped earlier. However, it never checks whether the mapping of the interrupt actially succeeded. Even more, should the firmware report an illegal interrupt number that overlaps with the GIC SGI range, this can result in an IPI being unmapped, and subsequent fireworks (as reported by Dann Frazier). Rework the driver to have a slightly saner behaviour and actually check whether the interrupt has been mapped before unmapping things. Reported-by: dann frazier <dann.frazier@canonical.com> Fixes: ca9ae5ec4ef0 ("acpi/arm64: Add SBSA Generic Watchdog support in GTDT driver") Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://lore.kernel.org/r/YH87dtTfwYgavusz@xps13.dannf Cc: stable@vgerlkernel.org Cc: Fu Wei <wefu@redhat.com> --- drivers/acpi/arm64/gtdt.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)