c2455bad5b
JIRA: https://issues.redhat.com/browse/RHEL-93889 commit 0686a818d77a431fc3ba2fab4b46bbb04e8c9380 Author: Jeffrey Hugo <quic_jhugo@quicinc.com> Date: Thu Mar 6 10:29:13 2025 -0700 bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. Cc: stable@vger.kernel.org # 6.8 Fixes: b89b6a863dd5 ("bus: mhi: host: Add spinlock to protect WP access when queueing TREs") Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Troy Hanson <quic_thanson@quicinc.com> Link: https://lore.kernel.org/r/20250306172913.856982-1-jeff.hugo@oss.qualcomm.com [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Mattijs Korpershoek <mkorpershoek@redhat.com> |
||
|---|---|---|
| .. | ||
| fsl-mc | ||
| mhi | ||
| Kconfig | ||
| Makefile | ||
| arm-cci.c | ||
| arm-integrator-lm.c | ||
| brcmstb_gisb.c | ||
| bt1-apb.c | ||
| bt1-axi.c | ||
| da8xx-mstpri.c | ||
| hisi_lpc.c | ||
| imx-weim.c | ||
| mips_cdmm.c | ||
| moxtet.c | ||
| mvebu-mbus.c | ||
| omap-ocp2scp.c | ||
| omap_l3_noc.c | ||
| omap_l3_noc.h | ||
| omap_l3_smx.c | ||
| omap_l3_smx.h | ||
| qcom-ebi2.c | ||
| simple-pm-bus.c | ||
| sun50i-de2.c | ||
| sunxi-rsb.c | ||
| tegra-aconnect.c | ||
| tegra-gmi.c | ||
| ti-pwmss.c | ||
| ti-sysc.c | ||
| ts-nbus.c | ||
| uniphier-system-bus.c | ||
| vexpress-config.c | ||