mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 08:46:46 +00:00
bus: mhi: core: Remove MHI event ring IRQ handlers when powering down
While powering down, the device may or may not acknowledge an MHI RESET issued by host for a graceful shutdown scenario and end up sending an incoming data packet after tasklets have been killed. If a rogue device sends this interrupt for a data transfer event ring update, it can result in a tasklet getting scheduled while a clean up is ongoing or has completed and cause access to freed memory leading to a NULL pointer exception. Remove the interrupt handlers for MHI event rings early on to avoid this scenario. Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
This commit is contained in:
parent
a03c7a86e1
commit
6cc1716102
1 changed files with 2 additions and 1 deletions
|
@ -494,6 +494,7 @@ static void mhi_pm_disable_transition(struct mhi_controller *mhi_cntrl)
|
|||
for (i = 0; i < mhi_cntrl->total_ev_rings; i++, mhi_event++) {
|
||||
if (mhi_event->offload_ev)
|
||||
continue;
|
||||
free_irq(mhi_cntrl->irq[mhi_event->irq], mhi_event);
|
||||
tasklet_kill(&mhi_event->task);
|
||||
}
|
||||
|
||||
|
@ -1164,7 +1165,7 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful)
|
|||
/* Wait for shutdown to complete */
|
||||
flush_work(&mhi_cntrl->st_worker);
|
||||
|
||||
mhi_deinit_free_irq(mhi_cntrl);
|
||||
free_irq(mhi_cntrl->irq[0], mhi_cntrl);
|
||||
|
||||
if (!mhi_cntrl->pre_init) {
|
||||
/* Free all allocated resources */
|
||||
|
|
Loading…
Reference in a new issue