]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
authorTudor Ambarus <tudor.ambarus@linaro.org>
Tue, 5 May 2026 13:13:04 +0000 (13:13 +0000)
committerKrzysztof Kozlowski <krzk@kernel.org>
Fri, 29 May 2026 12:11:23 +0000 (14:11 +0200)
commit7fe40c32a33905302341797b5d12c541729dd08d
tree9ed293fbdf49b8e39840fac8f0a76ecbcd8fd87c
parentbf296f83a3ddab1ab875edc4e8862cb10553064f
firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion

Sashiko identified a possible infinite loop [1].

ACPM IPC sequence numbers are tracked via a 64-bit bitmap. Previously,
acpm_prepare_xfer() used a do...while loop to search for a free
sequence number.

If all 63 available sequence numbers are leaked due to transient
hardware timeouts or mailbox failures, the bitmap becomes full.
The next call to acpm_prepare_xfer() would enter an infinite loop.

Fix this by utilizing the kernel's optimized bitmap search functions
(find_next_zero_bit / find_first_zero_bit). If the pool is completely
exhausted, log the failure and return -EBUSY to allow the kernel to
fail gracefully instead of hanging.

Furthermore, drop the allocation loop entirely. Because
acpm_prepare_xfer() is strictly called under the 'tx_lock' mutex,
sequence number allocations are perfectly serialized. If
find_next_zero_bit() locates a free bit, a single
test_and_set_bit_lock() is mathematically guaranteed to succeed.

To enforce this locking invariant, wrap the allocation in a
WARN_ON_ONCE. If the atomic set fails, it indicates the driver's
mutex serialization is fundamentally broken. The warning generates a
stack trace for debugging, while returning -EIO immediately aborts the
transfer to prevent silent payload corruption.

Cc: stable@vger.kernel.org
Fixes: a88927b534ba ("firmware: add Exynos ACPM protocol driver")
Closes: https://sashiko.dev/#/patchset/20260420-acpm-tmu-v3-0-3dc8e93f0b26%40linaro.org [1]
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://patch.msgid.link/20260505-acpm-fixes-sashiko-reports-v5-7-43b5ee7f1674@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
drivers/firmware/samsung/exynos-acpm.c