Commit 57cb0541 authored by Sergey Matsievskiy's avatar Sergey Matsievskiy Committed by Zeng Heng
Browse files

pinctrl: ocelot: fix system hang on level based interrupts

mainline inclusion
from mainline-v6.12-rc4
commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YX2
CVE: CVE-2024-50196

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=93b8ddc54507a227087c60a0013ed833b6ae7d3c



--------------------------------

The current implementation only calls chained_irq_enter() and
chained_irq_exit() if it detects pending interrupts.

```
for (i = 0; i < info->stride; i++) {
	uregmap_read(info->map, id_reg + 4 * i, &reg);
	if (!reg)
		continue;

	chained_irq_enter(parent_chip, desc);
```

However, in case of GPIO pin configured in level mode and the parent
controller configured in edge mode, GPIO interrupt might be lowered by the
hardware. In the result, if the interrupt is short enough, the parent
interrupt is still pending while the GPIO interrupt is cleared;
chained_irq_enter() never gets called and the system hangs trying to
service the parent interrupt.

Moving chained_irq_enter() and chained_irq_exit() outside the for loop
ensures that they are called even when GPIO interrupt is lowered by the
hardware.

The similar code with chained_irq_enter() / chained_irq_exit() functions
wrapping interrupt checking loop may be found in many other drivers:
```
grep -r -A 10 chained_irq_enter drivers/pinctrl
```

Cc: stable@vger.kernel.org
Signed-off-by: default avatarSergey Matsievskiy <matsievskiysv@gmail.com>
Reviewed-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com


Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Conflicts:
	drivers/pinctrl/pinctrl-ocelot.c
[Fix context conflicts.]
Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
parent 7ceda325
Loading
Loading
Loading
Loading
+3 −4
Original line number Diff line number Diff line
@@ -1097,22 +1097,21 @@ static void ocelot_irq_handler(struct irq_desc *desc)
	unsigned int reg = 0, irq, i;
	unsigned long irqs;

	chained_irq_enter(parent_chip, desc);

	for (i = 0; i < info->stride; i++) {
		regmap_read(info->map, id_reg + 4 * i, &reg);
		if (!reg)
			continue;

		chained_irq_enter(parent_chip, desc);

		irqs = reg;

		for_each_set_bit(irq, &irqs,
				 min(32U, info->desc->npins - 32 * i))
			generic_handle_irq(irq_linear_revmap(chip->irq.domain,
							     irq + 32 * i));

		chained_irq_exit(parent_chip, desc);
	}
	chained_irq_exit(parent_chip, desc);
}

static int ocelot_gpiochip_register(struct platform_device *pdev,