mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-04-08 12:02:33 +02:00
3568affcdd
As pointed out by Stephen Boyd it is possible that during initialization
of the pmic_glink child drivers, the protection-domain notifiers fires,
and the associated work is scheduled, before the client registration
returns and as a result the local "client" pointer has been initialized.
The outcome of this is a NULL pointer dereference as the "client"
pointer is blindly dereferenced.
Timeline provided by Stephen:
CPU0 CPU1
---- ----
ucsi->client = NULL;
devm_pmic_glink_register_client()
client->pdr_notify(client->priv, pg->client_state)
pmic_glink_ucsi_pdr_notify()
schedule_work(&ucsi->register_work)
<schedule away>
pmic_glink_ucsi_register()
ucsi_register()
pmic_glink_ucsi_read_version()
pmic_glink_ucsi_read()
pmic_glink_ucsi_read()
pmic_glink_send(ucsi->client)
<client is NULL BAD>
ucsi->client = client // Too late!
This code is identical across the altmode, battery manager and usci
child drivers.
Resolve this by splitting the allocation of the "client" object and the
registration thereof into two operations.
This only happens if the protection domain registry is populated at the
time of registration, which by the introduction of commit '1ebcde047c54
("soc: qcom: add pd-mapper implementation")' became much more likely.
Reported-by: Amit Pundir <amit.pundir@linaro.org>
Closes: https://lore.kernel.org/all/CAMi1Hd2_a7TjA7J9ShrAbNOd_CoZ3D87twmO5t+nZxC9sX18tA@mail.gmail.com/
Reported-by: Johan Hovold <johan@kernel.org>
Closes: https://lore.kernel.org/all/ZqiyLvP0gkBnuekL@hovoldconsulting.com/
Reported-by: Stephen Boyd <swboyd@chromium.org>
Closes: https://lore.kernel.org/all/CAE-0n52JgfCBWiFQyQWPji8cq_rCsviBpW-m72YitgNfdaEhQg@mail.gmail.com/
Fixes: 58ef4ece1e ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver")
Cc: stable@vger.kernel.org
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Amit Pundir <amit.pundir@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Link: https://lore.kernel.org/r/20240820-pmic-glink-v6-11-races-v3-1-eec53c750a04@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
34 lines
831 B
C
34 lines
831 B
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (c) 2022, Linaro Ltd
|
|
*/
|
|
#ifndef __SOC_QCOM_PMIC_GLINK_H__
|
|
#define __SOC_QCOM_PMIC_GLINK_H__
|
|
|
|
struct pmic_glink;
|
|
struct pmic_glink_client;
|
|
|
|
#define PMIC_GLINK_OWNER_BATTMGR 32778
|
|
#define PMIC_GLINK_OWNER_USBC 32779
|
|
#define PMIC_GLINK_OWNER_USBC_PAN 32780
|
|
|
|
#define PMIC_GLINK_REQ_RESP 1
|
|
#define PMIC_GLINK_NOTIFY 2
|
|
|
|
struct pmic_glink_hdr {
|
|
__le32 owner;
|
|
__le32 type;
|
|
__le32 opcode;
|
|
};
|
|
|
|
int pmic_glink_send(struct pmic_glink_client *client, void *data, size_t len);
|
|
|
|
struct pmic_glink_client *devm_pmic_glink_client_alloc(struct device *dev,
|
|
unsigned int id,
|
|
void (*cb)(const void *, size_t, void *),
|
|
void (*pdr)(void *, int),
|
|
void *priv);
|
|
void pmic_glink_client_register(struct pmic_glink_client *client);
|
|
|
|
#endif
|