| Message ID | 1613580211-22744-1-git-send-email-jhugo@codeaurora.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] bus: mhi: core: Check state before processing power_down | expand |
On Wed, Feb 17, 2021 at 09:43:31AM -0700, Jeffrey Hugo wrote: > We cannot process a power_down if the power state is DISABLED. There is > no valid mhi_ctxt in that case, so attepting to process the power_down > will likely result in a null pointer dereference. If the power state is > DISABLED, there is nothing to do anyways, so just bail early. > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> > --- > > v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock > > drivers/bus/mhi/core/pm.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c > index 56ba3ab..47f6621 100644 > --- a/drivers/bus/mhi/core/pm.c > +++ b/drivers/bus/mhi/core/pm.c > @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) > mhi_deinit_dev_ctxt(mhi_cntrl); > > error_dev_ctxt: > + mhi_cntrl->pm_state = MHI_PM_DISABLE; > mutex_unlock(&mhi_cntrl->pm_mutex); > > return ret; > @@ -1155,11 +1156,17 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) > enum mhi_pm_state cur_state, transition_state; > struct device *dev = &mhi_cntrl->mhi_dev->dev; > > + mutex_lock(&mhi_cntrl->pm_mutex); > + cur_state = mhi_cntrl->pm_state; As I said in my previous review, you should use pm_lock for reading the pm_state. Thanks, Mani > + if (cur_state == MHI_PM_DISABLE) { > + mutex_unlock(&mhi_cntrl->pm_mutex); > + return; /* Already powered down */ > + } > + > /* If it's not a graceful shutdown, force MHI to linkdown state */ > transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : > MHI_PM_LD_ERR_FATAL_DETECT; > > - mutex_lock(&mhi_cntrl->pm_mutex); > write_lock_irq(&mhi_cntrl->pm_lock); > cur_state = mhi_tryset_pm_state(mhi_cntrl, transition_state); > if (cur_state != transition_state) { > -- > Qualcomm Technologies, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project. >
On 2/24/2021 2:55 AM, Manivannan Sadhasivam wrote: > On Wed, Feb 17, 2021 at 09:43:31AM -0700, Jeffrey Hugo wrote: >> We cannot process a power_down if the power state is DISABLED. There is >> no valid mhi_ctxt in that case, so attepting to process the power_down >> will likely result in a null pointer dereference. If the power state is >> DISABLED, there is nothing to do anyways, so just bail early. >> >> Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> >> --- >> >> v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock >> >> drivers/bus/mhi/core/pm.c | 9 ++++++++- >> 1 file changed, 8 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c >> index 56ba3ab..47f6621 100644 >> --- a/drivers/bus/mhi/core/pm.c >> +++ b/drivers/bus/mhi/core/pm.c >> @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) >> mhi_deinit_dev_ctxt(mhi_cntrl); >> >> error_dev_ctxt: >> + mhi_cntrl->pm_state = MHI_PM_DISABLE; >> mutex_unlock(&mhi_cntrl->pm_mutex); >> >> return ret; >> @@ -1155,11 +1156,17 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) >> enum mhi_pm_state cur_state, transition_state; >> struct device *dev = &mhi_cntrl->mhi_dev->dev; >> >> + mutex_lock(&mhi_cntrl->pm_mutex); >> + cur_state = mhi_cntrl->pm_state; > > As I said in my previous review, you should use pm_lock for reading the > pm_state. You also said on IRC that is a refactor of the entire driver, and not a blocker for this fix. Based on that, I intrepreted your comments as nothing needed to be done regarding the locking, so I'm confused by this comment. I'm not entirely sure what you want since I feel like you are giving conflicting direction, but I'm guessing you want the lock of the pm_lock to be moved up to just under the mutex lock then?
On Wed, Feb 24, 2021 at 08:14:53AM -0700, Jeffrey Hugo wrote: > On 2/24/2021 2:55 AM, Manivannan Sadhasivam wrote: > > On Wed, Feb 17, 2021 at 09:43:31AM -0700, Jeffrey Hugo wrote: > > > We cannot process a power_down if the power state is DISABLED. There is > > > no valid mhi_ctxt in that case, so attepting to process the power_down > > > will likely result in a null pointer dereference. If the power state is > > > DISABLED, there is nothing to do anyways, so just bail early. > > > > > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> > > > --- > > > > > > v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock > > > > > > drivers/bus/mhi/core/pm.c | 9 ++++++++- > > > 1 file changed, 8 insertions(+), 1 deletion(-) > > > > > > diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c > > > index 56ba3ab..47f6621 100644 > > > --- a/drivers/bus/mhi/core/pm.c > > > +++ b/drivers/bus/mhi/core/pm.c > > > @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) > > > mhi_deinit_dev_ctxt(mhi_cntrl); > > > error_dev_ctxt: > > > + mhi_cntrl->pm_state = MHI_PM_DISABLE; > > > mutex_unlock(&mhi_cntrl->pm_mutex); > > > return ret; > > > @@ -1155,11 +1156,17 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) > > > enum mhi_pm_state cur_state, transition_state; > > > struct device *dev = &mhi_cntrl->mhi_dev->dev; > > > + mutex_lock(&mhi_cntrl->pm_mutex); > > > + cur_state = mhi_cntrl->pm_state; > > > > As I said in my previous review, you should use pm_lock for reading the > > pm_state. > > You also said on IRC that is a refactor of the entire driver, and not a > blocker for this fix. Based on that, I intrepreted your comments as nothing > needed to be done regarding the locking, so I'm confused by this comment. > > I'm not entirely sure what you want since I feel like you are giving > conflicting direction, but I'm guessing you want the lock of the pm_lock to > be moved up to just under the mutex lock then? > Yes, that's what my intention is. Sorry if I confused you. Thanks, Mani > -- > Jeffrey Hugo > Qualcomm Technologies, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project.
diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c index 56ba3ab..47f6621 100644 --- a/drivers/bus/mhi/core/pm.c +++ b/drivers/bus/mhi/core/pm.c @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) mhi_deinit_dev_ctxt(mhi_cntrl); error_dev_ctxt: + mhi_cntrl->pm_state = MHI_PM_DISABLE; mutex_unlock(&mhi_cntrl->pm_mutex); return ret; @@ -1155,11 +1156,17 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) enum mhi_pm_state cur_state, transition_state; struct device *dev = &mhi_cntrl->mhi_dev->dev; + mutex_lock(&mhi_cntrl->pm_mutex); + cur_state = mhi_cntrl->pm_state; + if (cur_state == MHI_PM_DISABLE) { + mutex_unlock(&mhi_cntrl->pm_mutex); + return; /* Already powered down */ + } + /* If it's not a graceful shutdown, force MHI to linkdown state */ transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : MHI_PM_LD_ERR_FATAL_DETECT; - mutex_lock(&mhi_cntrl->pm_mutex); write_lock_irq(&mhi_cntrl->pm_lock); cur_state = mhi_tryset_pm_state(mhi_cntrl, transition_state); if (cur_state != transition_state) {
We cannot process a power_down if the power state is DISABLED. There is no valid mhi_ctxt in that case, so attepting to process the power_down will likely result in a null pointer dereference. If the power state is DISABLED, there is nothing to do anyways, so just bail early. Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> --- v2: Fix subject and tweak the locking to avoid needless lock/unlock/relock drivers/bus/mhi/core/pm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)