]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
pinmux: Use sequential access to access desc->pinmux data
authorMukesh Ojha <quic_mojha@quicinc.com>
Mon, 14 Oct 2024 19:29:30 +0000 (00:59 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 19:03:59 +0000 (20:03 +0100)
commitc11e2ec9a780f54982a187ee10ffd1b810715c85
tree3ac87c33bbd37a2ab04565668f301fc73d91cac3
parent09c083fbea760f85567aabb00b17458c500f83c0
pinmux: Use sequential access to access desc->pinmux data

[ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ]

When two client of the same gpio call pinctrl_select_state() for the
same functionality, we are seeing NULL pointer issue while accessing
desc->mux_owner.

Let's say two processes A, B executing in pin_request() for the same pin
and process A updates the desc->mux_usecount but not yet updated the
desc->mux_owner while process B see the desc->mux_usecount which got
updated by A path and further executes strcmp and while accessing
desc->mux_owner it crashes with NULL pointer.

Serialize the access to mux related setting with a mutex lock.

cpu0 (process A) cpu1(process B)

pinctrl_select_state() {   pinctrl_select_state() {
  pin_request() { pin_request() {
  ...
 ....
    } else {
         desc->mux_usecount++;
     desc->mux_usecount && strcmp(desc->mux_owner, owner)) {

         if (desc->mux_usecount > 1)
               return 0;
         desc->mux_owner = owner;

  } }

Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/pinctrl/core.c
drivers/pinctrl/core.h
drivers/pinctrl/pinmux.c