diff options
| author | Jarkko Nikula <jarkko.nikula@linux.intel.com> | 2024-09-20 17:44:31 +0300 |
|---|---|---|
| committer | Alexandre Belloni <alexandre.belloni@bootlin.com> | 2024-11-01 00:06:14 +0100 |
| commit | 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 (patch) | |
| tree | 1c3efbe45c28d1029026955194b1c488981a6b92 /drivers/i3c | |
| parent | 3082990592f7c6d7510a9133afa46e31bbe26533 (diff) | |
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().
Prevent this my masking the ring interrupts before ring stop request.
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Diffstat (limited to 'drivers/i3c')
| -rw-r--r-- | drivers/i3c/master/mipi-i3c-hci/dma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index a918e96b21fd..13adc5840094 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -159,10 +159,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci) for (i = 0; i < rings->total; i++) { rh = &rings->headers[i]; + rh_reg_write(INTR_SIGNAL_ENABLE, 0); rh_reg_write(RING_CONTROL, 0); rh_reg_write(CR_SETUP, 0); rh_reg_write(IBI_SETUP, 0); - rh_reg_write(INTR_SIGNAL_ENABLE, 0); if (rh->xfer) dma_free_coherent(&hci->master.dev, |