Commit 355255a8 authored Feb 06, 2025 by Jarkko Nikula Committed by Yu Kuai Feb 06, 2025

i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request

stable inclusion
from stable-v6.6.66
commit a6dc4b4fda2e147e557050eaae51ff15edeb680b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEV
CVE: CVE-2024-45828

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6dc4b4fda2e147e557050eaae51ff15edeb680b



--------------------------------

[ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ]

Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().

Prevent this my masking the ring interrupts before ring stop request.

Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.com


Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>

parent 34209ddd

drivers/i3c/master/mipi-i3c-hci/dma.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -174,10 +174,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci)
		for (i = 0; i < rings->total; i++) {
		rh = &rings->headers[i];

		rh_reg_write(INTR_SIGNAL_ENABLE, 0);
		rh_reg_write(RING_CONTROL, 0);
		rh_reg_write(CR_SETUP, 0);
		rh_reg_write(IBI_SETUP, 0);
		rh_reg_write(INTR_SIGNAL_ENABLE, 0);

		if (rh->xfer)
		dma_free_coherent(&hci->master.dev,