| Message ID | 1613511496-22271-1-git-send-email-jhugo@codeaurora.org |
|---|---|
| State | New |
| Headers | show |
| Series | mhi_bus: core: Check state before processing power_down | expand |
On Tue, Feb 16, 2021 at 02:38:16PM -0700, Jeffrey Hugo wrote: > We cannot process a power_down if the power state is DISABLED. There is > no valid mhi_ctxt in that case, so attepting to process the power_down > will likely result in a null pointer dereference. If the power state is > DISABLED, there is nothing to do anyways, so just bail early. > > Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> > --- > drivers/bus/mhi/core/pm.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c > index 56ba3ab..dc69074 100644 > --- a/drivers/bus/mhi/core/pm.c > +++ b/drivers/bus/mhi/core/pm.c > @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) > mhi_deinit_dev_ctxt(mhi_cntrl); > > error_dev_ctxt: > + mhi_cntrl->pm_state = MHI_PM_DISABLE; > mutex_unlock(&mhi_cntrl->pm_mutex); pm_lock is supposed to protect the PM state. The current code needs a cleanup interms of locking. It's been on my TODO list for sometime... > > return ret; > @@ -1155,6 +1156,12 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) > enum mhi_pm_state cur_state, transition_state; > struct device *dev = &mhi_cntrl->mhi_dev->dev; > > + mutex_lock(&mhi_cntrl->pm_mutex); > + cur_state = mhi_cntrl->pm_state; > + mutex_unlock(&mhi_cntrl->pm_mutex); Same here. Thanks, Mani > + if (cur_state == MHI_PM_DISABLE) > + return; /* Already powered down */ > + > /* If it's not a graceful shutdown, force MHI to linkdown state */ > transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : > MHI_PM_LD_ERR_FATAL_DETECT; > -- > Qualcomm Technologies, Inc. is a member of the > Code Aurora Forum, a Linux Foundation Collaborative Project. >
diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c index 56ba3ab..dc69074 100644 --- a/drivers/bus/mhi/core/pm.c +++ b/drivers/bus/mhi/core/pm.c @@ -1144,6 +1144,7 @@ int mhi_async_power_up(struct mhi_controller *mhi_cntrl) mhi_deinit_dev_ctxt(mhi_cntrl); error_dev_ctxt: + mhi_cntrl->pm_state = MHI_PM_DISABLE; mutex_unlock(&mhi_cntrl->pm_mutex); return ret; @@ -1155,6 +1156,12 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful) enum mhi_pm_state cur_state, transition_state; struct device *dev = &mhi_cntrl->mhi_dev->dev; + mutex_lock(&mhi_cntrl->pm_mutex); + cur_state = mhi_cntrl->pm_state; + mutex_unlock(&mhi_cntrl->pm_mutex); + if (cur_state == MHI_PM_DISABLE) + return; /* Already powered down */ + /* If it's not a graceful shutdown, force MHI to linkdown state */ transition_state = (graceful) ? MHI_PM_SHUTDOWN_PROCESS : MHI_PM_LD_ERR_FATAL_DETECT;
We cannot process a power_down if the power state is DISABLED. There is no valid mhi_ctxt in that case, so attepting to process the power_down will likely result in a null pointer dereference. If the power state is DISABLED, there is nothing to do anyways, so just bail early. Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org> --- drivers/bus/mhi/core/pm.c | 7 +++++++ 1 file changed, 7 insertions(+)