linux-stable/drivers/i2c
Dhananjay Phadke b1eef236f5 i2c: iproc: fix race between client unreg and isr
When i2c client unregisters, synchronize irq before setting
iproc_i2c->slave to NULL.

(1) disable_irq()
(2) Mask event enable bits in control reg
(3) Erase slave address (avoid further writes to rx fifo)
(4) Flush tx and rx FIFOs
(5) Clear pending event (interrupt) bits in status reg
(6) enable_irq()
(7) Set client pointer to NULL

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000318

[  371.020421] pc : bcm_iproc_i2c_isr+0x530/0x11f0
[  371.025098] lr : __handle_irq_event_percpu+0x6c/0x170
[  371.030309] sp : ffff800010003e40
[  371.033727] x29: ffff800010003e40 x28: 0000000000000060
[  371.039206] x27: ffff800010ca9de0 x26: ffff800010f895df
[  371.044686] x25: ffff800010f18888 x24: ffff0008f7ff3600
[  371.050165] x23: 0000000000000003 x22: 0000000001600000
[  371.055645] x21: ffff800010f18888 x20: 0000000001600000
[  371.061124] x19: ffff0008f726f080 x18: 0000000000000000
[  371.066603] x17: 0000000000000000 x16: 0000000000000000
[  371.072082] x15: 0000000000000000 x14: 0000000000000000
[  371.077561] x13: 0000000000000000 x12: 0000000000000001
[  371.083040] x11: 0000000000000000 x10: 0000000000000040
[  371.088519] x9 : ffff800010f317c8 x8 : ffff800010f317c0
[  371.093999] x7 : ffff0008f805b3b0 x6 : 0000000000000000
[  371.099478] x5 : ffff0008f7ff36a4 x4 : ffff8008ee43d000
[  371.104957] x3 : 0000000000000000 x2 : ffff8000107d64c0
[  371.110436] x1 : 00000000c00000af x0 : 0000000000000000

[  371.115916] Call trace:
[  371.118439]  bcm_iproc_i2c_isr+0x530/0x11f0
[  371.122754]  __handle_irq_event_percpu+0x6c/0x170
[  371.127606]  handle_irq_event_percpu+0x34/0x88
[  371.132189]  handle_irq_event+0x40/0x120
[  371.136234]  handle_fasteoi_irq+0xcc/0x1a0
[  371.140459]  generic_handle_irq+0x24/0x38
[  371.144594]  __handle_domain_irq+0x60/0xb8
[  371.148820]  gic_handle_irq+0xc0/0x158
[  371.152687]  el1_irq+0xb8/0x140
[  371.155927]  arch_cpu_idle+0x10/0x18
[  371.159615]  do_idle+0x204/0x290
[  371.162943]  cpu_startup_entry+0x24/0x60
[  371.166990]  rest_init+0xb0/0xbc
[  371.170322]  arch_call_rest_init+0xc/0x14
[  371.174458]  start_kernel+0x404/0x430

Fixes: c245d94ed1 ("i2c: iproc: Add multi byte read-write support for slave mode")

Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2020-08-12 22:03:58 +02:00
..
algos Linux 5.8-rc7 2020-07-31 15:54:27 +02:00
busses i2c: iproc: fix race between client unreg and isr 2020-08-12 22:03:58 +02:00
muxes Merge branch 'i2c/for-current-fixed' into i2c/for-5.8 2020-05-20 15:27:45 +02:00
i2c-boardinfo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
i2c-core-acpi.c i2c: acpi: Drop double check for ACPI companion device 2020-05-28 18:01:20 +02:00
i2c-core-base.c i2c: core: treat EPROBE_DEFER when acquiring SCL/SDA GPIOs 2020-08-05 11:52:27 +02:00
i2c-core-of.c i2c: use my kernel.org address from now on 2020-05-05 16:29:09 +02:00
i2c-core-slave.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
i2c-core-smbus.c i2c: core: check returned size of emulated smbus block read 2020-06-26 10:18:35 +02:00
i2c-core.h i2c: reword explanation about atomic transfers 2020-05-20 15:25:55 +02:00
i2c-dev.c i2c: Use separate MODULE_AUTHOR() statements for multiple authors 2020-07-04 08:25:13 +02:00
i2c-mux.c i2c: mux: add sysfs header 2019-06-22 07:32:33 +02:00
i2c-slave-eeprom.c i2c: busses: Use fallthrough pseudo-keyword 2020-07-23 22:04:08 +02:00
i2c-smbus.c i2c: smbus: Add a way to instantiate SPD EEPROMs automatically 2020-05-29 12:53:04 +02:00
i2c-stub.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
Kconfig i2c: add Kconfig help text for slave mode 2020-07-04 08:17:53 +02:00
Makefile