]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
authorJarkko Nikula <jarkko.nikula@linux.intel.com>
Fri, 20 Sep 2024 14:44:31 +0000 (17:44 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 18:51:41 +0000 (19:51 +0100)
commita6cddf68b3405b272b5a3cad9657be0b02b34bf4
tree43b8abbfcecc7d9a7fdc7da61c59802e04df6c8c
parenta365de2fbfbe1e6740bfb75ab5c3245cf7bbe4d7
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request

[ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ]

Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().

Prevent this my masking the ring interrupts before ring stop request.

Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/i3c/master/mipi-i3c-hci/dma.c