OERV-BSP/kernel-starfive-jh7110
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mfd: qcom-pm8xxx: Fix potential deadlock on &chip->pm_irq_lock

Browse Source 
As &chip->pm_irq_lock is acquired by pm8xxx_irq_handler() under irq
context, other process context code should disable irq before acquiring
the lock.

Since .irq_set_type and .irq_get_irqchip_state callbacks are generally
executed from process context without irq disabled by default, the same
lock acquision should disable irq.

Possible deadlock scenario
pm8xxx_irq_set_type()
    -> pm8xxx_config_irq()
    -> spin_lock(&chip->pm_irq_lock)
        <irq interrupt>
        -> pm8xxx_irq_handler()
        -> pm8xxx_irq_master_handler()
        -> pm8xxx_irq_block_handler()
        -> pm8xxx_read_block_irq()
        -> spin_lock(&chip->pm_irq_lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

Fix the potential deadlock by spin_lock_irqsave().

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Bjorn Andersson <quic_bjorande@quicinc.com>
Link: https://lore.kernel.org/r/20230720071330.50382-1-dg573847474@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
This commit is contained in:
Chengfeng Ye
2023-07-20 07:13:30 +00:00
committed by Lee Jones
parent 506fbc6b37
commit f1a63db65e
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/mfd/qcom-pm8xxx.c
View File

@@ -103,8 +103,9 @@ static int
pm8xxx_config_irq(struct pm_irq_chip *chip, unsigned int bp, unsigned int cp) pm8xxx_config_irq(struct pm_irq_chip *chip, unsigned int bp, unsigned int cp)
{ {
int rc; int rc;
unsigned long flags;
spin_lock(&chip->pm_irq_lock); spin_lock_irqsave(&chip->pm_irq_lock, flags);
rc = regmap_write(chip->regmap, SSBI_REG_ADDR_IRQ_BLK_SEL, bp); rc = regmap_write(chip->regmap, SSBI_REG_ADDR_IRQ_BLK_SEL, bp);
if (rc) { if (rc) {
pr_err("Failed Selecting Block %d rc=%d\n", bp, rc); pr_err("Failed Selecting Block %d rc=%d\n", bp, rc);
@@ -116,7 +117,7 @@ pm8xxx_config_irq(struct pm_irq_chip *chip, unsigned int bp, unsigned int cp)
if (rc) if (rc)
pr_err("Failed Configuring IRQ rc=%d\n", rc); pr_err("Failed Configuring IRQ rc=%d\n", rc);
bail: bail:
spin_unlock(&chip->pm_irq_lock); spin_unlock_irqrestore(&chip->pm_irq_lock, flags);
return rc; return rc;
} }
@@ -321,6 +322,7 @@ static int pm8xxx_irq_get_irqchip_state(struct irq_data *d,
struct pm_irq_chip *chip = irq_data_get_irq_chip_data(d); struct pm_irq_chip *chip = irq_data_get_irq_chip_data(d);
unsigned int pmirq = irqd_to_hwirq(d); unsigned int pmirq = irqd_to_hwirq(d);
unsigned int bits; unsigned int bits;
unsigned long flags;
int irq_bit; int irq_bit;
u8 block; u8 block;
int rc; int rc;
@@ -331,7 +333,7 @@ static int pm8xxx_irq_get_irqchip_state(struct irq_data *d,
block = pmirq / 8; block = pmirq / 8;
irq_bit = pmirq % 8; irq_bit = pmirq % 8;
spin_lock(&chip->pm_irq_lock); spin_lock_irqsave(&chip->pm_irq_lock, flags);
rc = regmap_write(chip->regmap, SSBI_REG_ADDR_IRQ_BLK_SEL, block); rc = regmap_write(chip->regmap, SSBI_REG_ADDR_IRQ_BLK_SEL, block);
if (rc) { if (rc) {
pr_err("Failed Selecting Block %d rc=%d\n", block, rc); pr_err("Failed Selecting Block %d rc=%d\n", block, rc);
@@ -346,7 +348,7 @@ static int pm8xxx_irq_get_irqchip_state(struct irq_data *d,
*state = !!(bits & BIT(irq_bit)); *state = !!(bits & BIT(irq_bit));
bail: bail:
spin_unlock(&chip->pm_irq_lock); spin_unlock_irqrestore(&chip->pm_irq_lock, flags);
return rc; return rc;
} }