Commit b53e9758 authored by Billy Tsai's avatar Billy Tsai Committed by Alexandre Belloni
Browse files

i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. 



The `i3c_master_bus_init` function may attach the I2C devices before the
I3C bus initialization. In this flow, the DAT `alloc_entry`` will be used
before the DAT `init`. Additionally, if the `i3c_master_bus_init` fails,
the DAT `cleanup` will execute before the device is detached, which will
execue DAT `free_entry` function. The above scenario can cause the driver
to use DAT_data when it is NULL.

Signed-off-by: default avatarBilly Tsai <billy_tsai@aspeedtech.com>
Link: https://lore.kernel.org/r/20231023080237.560936-1-billy_tsai@aspeedtech.com


Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
parent 8911eae9

drivers/i3c/master/mipi-i3c-hci/dat_v1.c

+19 −10
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ static int hci_dat_v1_init(struct i3c_hci *hci) 
		return -EOPNOTSUPP;

	}



	if (!hci->DAT_data) {

		/* use a bitmap for faster free slot search */

		hci->DAT_data = bitmap_zalloc(hci->DAT_entries, GFP_KERNEL);

		if (!hci->DAT_data)
@@ -74,6 +75,7 @@ static int hci_dat_v1_init(struct i3c_hci *hci) 
			dat_w0_write(dat_idx, 0);

			dat_w1_write(dat_idx, 0);

		}

	}



	return 0;

}
@@ -87,7 +89,13 @@ static void hci_dat_v1_cleanup(struct i3c_hci *hci) 
static int hci_dat_v1_alloc_entry(struct i3c_hci *hci)

{

	unsigned int dat_idx;

	int ret;



	if (!hci->DAT_data) {

		ret = hci_dat_v1_init(hci);

		if (ret)

			return ret;

	}

	dat_idx = find_first_zero_bit(hci->DAT_data, hci->DAT_entries);

	if (dat_idx >= hci->DAT_entries)

		return -ENOENT;
@@ -103,6 +111,7 @@ static void hci_dat_v1_free_entry(struct i3c_hci *hci, unsigned int dat_idx) 
{

	dat_w0_write(dat_idx, 0);

	dat_w1_write(dat_idx, 0);

	if (hci->DAT_data)

		__clear_bit(dat_idx, hci->DAT_data);

}