| Message ID | 1612812784-26369-1-git-send-email-subbaram@codeaurora.org |
|---|---|
| State | Accepted |
| Commit | d19db80a366576d3ffadf2508ed876b4c1faf959 |
| Headers | show |
| Series | spmi: spmi-pmic-arb: Fix hw_irq overflow | expand |
Quoting Subbaraman Narayanamurthy (2021-02-08 11:33:04) > Currently, when handling the SPMI summary interrupt, the hw_irq > number is calculated based on SID, Peripheral ID, IRQ index and > APID. This is then passed to irq_find_mapping() to see if a > mapping exists for this hw_irq and if available, invoke the > interrupt handler. Since the IRQ index uses an "int" type, hw_irq > which is of unsigned long data type can take a large value when > SID has its MSB set to 1 and the type conversion happens. Because > of this, irq_find_mapping() returns 0 as there is no mapping > for this hw_irq. This ends up invoking cleanup_irq() as if > the interrupt is spurious whereas it is actually a valid > interrupt. Fix this by using the proper data type (u32) for id. > > Cc: stable@vger.kernel.org > Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org> > --- Applied to spmi-next
Hello: This patch was applied to qcom/linux.git (refs/heads/for-next): On Mon, 8 Feb 2021 11:33:04 -0800 you wrote: > Currently, when handling the SPMI summary interrupt, the hw_irq > number is calculated based on SID, Peripheral ID, IRQ index and > APID. This is then passed to irq_find_mapping() to see if a > mapping exists for this hw_irq and if available, invoke the > interrupt handler. Since the IRQ index uses an "int" type, hw_irq > which is of unsigned long data type can take a large value when > SID has its MSB set to 1 and the type conversion happens. Because > of this, irq_find_mapping() returns 0 as there is no mapping > for this hw_irq. This ends up invoking cleanup_irq() as if > the interrupt is spurious whereas it is actually a valid > interrupt. Fix this by using the proper data type (u32) for id. > > [...] Here is the summary with links: - spmi: spmi-pmic-arb: Fix hw_irq overflow https://git.kernel.org/qcom/c/d19db80a3665 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c index de844b4..bbbd311 100644 --- a/drivers/spmi/spmi-pmic-arb.c +++ b/drivers/spmi/spmi-pmic-arb.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2015, 2017, 2021, The Linux Foundation. All rights reserved. */ #include <linux/bitmap.h> #include <linux/delay.h> @@ -505,8 +505,7 @@ static void cleanup_irq(struct spmi_pmic_arb *pmic_arb, u16 apid, int id) static void periph_interrupt(struct spmi_pmic_arb *pmic_arb, u16 apid) { unsigned int irq; - u32 status; - int id; + u32 status, id; u8 sid = (pmic_arb->apid_data[apid].ppid >> 8) & 0xF; u8 per = pmic_arb->apid_data[apid].ppid & 0xFF;
Currently, when handling the SPMI summary interrupt, the hw_irq number is calculated based on SID, Peripheral ID, IRQ index and APID. This is then passed to irq_find_mapping() to see if a mapping exists for this hw_irq and if available, invoke the interrupt handler. Since the IRQ index uses an "int" type, hw_irq which is of unsigned long data type can take a large value when SID has its MSB set to 1 and the type conversion happens. Because of this, irq_find_mapping() returns 0 as there is no mapping for this hw_irq. This ends up invoking cleanup_irq() as if the interrupt is spurious whereas it is actually a valid interrupt. Fix this by using the proper data type (u32) for id. Cc: stable@vger.kernel.org Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org> --- drivers/spmi/spmi-pmic-arb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)