| Message ID | 1615409365-8165-1-git-send-email-jhugo@codeaurora.org |
|---|---|
| State | Accepted |
| Commit | 9e40641f62cd812b21f2c73b5cfb3346eb466dea |
| Headers | show |
| Series | [v3] bus: mhi: core: Check state before processing power_down | expand |
On Wed, Mar 10, 2021 at 01:49:25PM -0700, Jeffrey Hugo wrote: > We cannot process a power_down if the power state is DISABLED. There is > no valid mhi_ctxt in that case, so attepting to process the power_down > will likely result in a null pointer dereference. If the power state is > DISABLED, there is nothing to do anyways, so just bail early. > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Thanks, Mani > --- > > v3: Move the pm_lock use up > v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock > > drivers/bus/mhi/core/pm.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c > index 414da4f..ea62549 100644 > --- a/drivers/bus/mhi/core/pm.c > +++ b/drivers/bus/mhi/core/pm.c > @@ -1149,6 +1149,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) > mhi_deinit_dev_ctxt(mhi_cntrl); > > error_dev_ctxt: > + mhi_cntrl->pm_state = MHI_PM_DISABLE; > mutex_unlock(&mhi_cntrl->pm_mutex); > > return ret; > @@ -1160,12 +1161,19 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) > enum mhi_pm_state cur_state, transition_state; > struct device *dev = &mhi_cntrl->mhi_dev->dev; > > + mutex_lock(&mhi_cntrl->pm_mutex); > + write_lock_irq(&mhi_cntrl->pm_lock); > + cur_state = mhi_cntrl->pm_state; > + if (cur_state == MHI_PM_DISABLE) { > + write_unlock_irq(&mhi_cntrl->pm_lock); > + mutex_unlock(&mhi_cntrl->pm_mutex); > + return; /* Already powered down */ > + } > + > /* If it's not a graceful shutdown, force MHI to linkdown state */ > transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : > MHI_PM_LD_ERR_FATAL_DETECT; > > - mutex_lock(&mhi_cntrl->pm_mutex); > - write_lock_irq(&mhi_cntrl->pm_lock); > cur_state = mhi_tryset_pm_state(mhi_cntrl, transition_state); > if (cur_state != transition_state) { > dev_err(dev, "Failed to move to state: %s from: %s\n", > -- > Qualcomm Technologies, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project. >
On Wed, Mar 10, 2021 at 01:49:25PM -0700, Jeffrey Hugo wrote: > We cannot process a power_down if the power state is DISABLED. There is > no valid mhi_ctxt in that case, so attepting to process the power_down > will likely result in a null pointer dereference. If the power state is > DISABLED, there is nothing to do anyways, so just bail early. > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> Applied to mhi-next! Thanks, Mani > --- > > v3: Move the pm_lock use up > v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock > > drivers/bus/mhi/core/pm.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c > index 414da4f..ea62549 100644 > --- a/drivers/bus/mhi/core/pm.c > +++ b/drivers/bus/mhi/core/pm.c > @@ -1149,6 +1149,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) > mhi_deinit_dev_ctxt(mhi_cntrl); > > error_dev_ctxt: > + mhi_cntrl->pm_state = MHI_PM_DISABLE; > mutex_unlock(&mhi_cntrl->pm_mutex); > > return ret; > @@ -1160,12 +1161,19 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) > enum mhi_pm_state cur_state, transition_state; > struct device *dev = &mhi_cntrl->mhi_dev->dev; > > + mutex_lock(&mhi_cntrl->pm_mutex); > + write_lock_irq(&mhi_cntrl->pm_lock); > + cur_state = mhi_cntrl->pm_state; > + if (cur_state == MHI_PM_DISABLE) { > + write_unlock_irq(&mhi_cntrl->pm_lock); > + mutex_unlock(&mhi_cntrl->pm_mutex); > + return; /* Already powered down */ > + } > + > /* If it's not a graceful shutdown, force MHI to linkdown state */ > transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : > MHI_PM_LD_ERR_FATAL_DETECT; > > - mutex_lock(&mhi_cntrl->pm_mutex); > - write_lock_irq(&mhi_cntrl->pm_lock); > cur_state = mhi_tryset_pm_state(mhi_cntrl, transition_state); > if (cur_state != transition_state) { > dev_err(dev, "Failed to move to state: %s from: %s\n", > -- > Qualcomm Technologies, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project. >
Hello: This patch was applied to qcom/linux.git (refs/heads/for-next): On Wed, 10 Mar 2021 13:49:25 -0700 you wrote: > We cannot process a power_down if the power state is DISABLED. There is > no valid mhi_ctxt in that case, so attepting to process the power_down > will likely result in a null pointer dereference. If the power state is > DISABLED, there is nothing to do anyways, so just bail early. > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> > > [...] Here is the summary with links: - [v3] bus: mhi: core: Check state before processing power_down https://git.kernel.org/qcom/c/9e40641f62cd You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c index 414da4f..ea62549 100644 --- a/drivers/bus/mhi/core/pm.c +++ b/drivers/bus/mhi/core/pm.c @@ -1149,6 +1149,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) mhi_deinit_dev_ctxt(mhi_cntrl); error_dev_ctxt: + mhi_cntrl->pm_state = MHI_PM_DISABLE; mutex_unlock(&mhi_cntrl->pm_mutex); return ret; @@ -1160,12 +1161,19 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) enum mhi_pm_state cur_state, transition_state; struct device *dev = &mhi_cntrl->mhi_dev->dev; + mutex_lock(&mhi_cntrl->pm_mutex); + write_lock_irq(&mhi_cntrl->pm_lock); + cur_state = mhi_cntrl->pm_state; + if (cur_state == MHI_PM_DISABLE) { + write_unlock_irq(&mhi_cntrl->pm_lock); + mutex_unlock(&mhi_cntrl->pm_mutex); + return; /* Already powered down */ + } + /* If it's not a graceful shutdown, force MHI to linkdown state */ transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : MHI_PM_LD_ERR_FATAL_DETECT; - mutex_lock(&mhi_cntrl->pm_mutex); - write_lock_irq(&mhi_cntrl->pm_lock); cur_state = mhi_tryset_pm_state(mhi_cntrl, transition_state); if (cur_state != transition_state) { dev_err(dev, "Failed to move to state: %s from: %s\n",
We cannot process a power_down if the power state is DISABLED. There is no valid mhi_ctxt in that case, so attepting to process the power_down will likely result in a null pointer dereference. If the power state is DISABLED, there is nothing to do anyways, so just bail early. Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> --- v3: Move the pm_lock use up v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock drivers/bus/mhi/core/pm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)