mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 09:20:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

i3c: renesas: Check that the transfer is valid before accessing it

Browse Source 
The Renesas I3C driver uses an asynchronous model to transfer data. It
prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion.
The interrupt handler dequeues the transfer, updates/uses it, and signals
the waiting thread.

If the completion times out, the waiting thread dequeues the transfer and
free it. If an interrupt fires after that, the handler may access freed
memory, leading to crashes.

Check that the transfer is still valid before accessing it in the
interrupt handler. With it clear any status flags and disable all
the interrupts to avoid triggering the same interrupts again.

Fixes: d028219a9f ("i3c: master: Add basic driver for the Renesas I3C controller")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com>
Link: https://patch.msgid.link/20260713130545.568657-2-claudiu.beznea+renesas@tuxon.dev
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
This commit is contained in:
Claudiu Beznea
2026-07-13 16:05:29 +03:00
committed by Alexandre Belloni
parent 629a6ddd1d
commit 5f1a76ecfe
1 changed files with 45 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
drivers/i3c/master/renesas-i3c.c
View File

@@ -433,6 +433,21 @@ static void renesas_i3c_enqueue_xfer(struct renesas_i3c *i3c, struct renesas_i3c
}
}
static void renesas_i3c_irqs_mask_and_clear_locked(struct renesas_i3c *i3c)
{
/* Disable all the interrupts. */
renesas_writel(i3c->regs, BIE, 0);
renesas_writel(i3c->regs, NTIE, 0);
/* Clear normal transfer status flags. */
renesas_writel(i3c->regs, NTST, 0);
/* Clear bus status flags. */
renesas_writel(i3c->regs, BST, 0);
/* Read back registers to confirm writes have fully propagated. */
renesas_readl(i3c->regs, BST);
}
static void renesas_i3c_wait_xfer(struct renesas_i3c *i3c, struct renesas_i3c_xfer *xfer)
{
unsigned long time_left;
@@ -1016,6 +1031,11 @@ static irqreturn_t renesas_i3c_tx_isr(int irq, void *data)
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
if (!xfer) {
renesas_i3c_irqs_mask_and_clear_locked(i3c);
return IRQ_HANDLED;
}
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1056,6 +1076,11 @@ static irqreturn_t renesas_i3c_resp_isr(int irq, void *data)
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
if (!xfer) {
renesas_i3c_irqs_mask_and_clear_locked(i3c);
return IRQ_HANDLED;
}
cmd = xfer->cmds;
/* Clear the Respone Queue Full status flag*/
@@ -1146,6 +1171,11 @@ static irqreturn_t renesas_i3c_tend_isr(int irq, void *data)
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
if (!xfer) {
renesas_i3c_irqs_mask_and_clear_locked(i3c);
return IRQ_HANDLED;
}
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1192,6 +1222,11 @@ static irqreturn_t renesas_i3c_rx_isr(int irq, void *data)
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
if (!xfer) {
renesas_i3c_irqs_mask_and_clear_locked(i3c);
return IRQ_HANDLED;
}
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {
@@ -1242,15 +1277,13 @@ static irqreturn_t renesas_i3c_stop_isr(int irq, void *data)
struct renesas_i3c_xfer *xfer;
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
/* read back registers to confirm writes have fully propagated */
renesas_writel(i3c->regs, BST, 0);
renesas_readl(i3c->regs, BST);
renesas_writel(i3c->regs, BIE, 0);
renesas_clear_bit(i3c->regs, NTST, NTST_TDBEF0 | NTST_RDBFF0);
renesas_i3c_irqs_mask_and_clear_locked(i3c);
renesas_clear_bit(i3c->regs, SCSTRCTL, SCSTRCTL_RWE);
xfer = i3c->xferqueue.cur;
if (!xfer)
return IRQ_HANDLED;
xfer->ret = 0;
complete(&xfer->comp);
}
@@ -1267,6 +1300,11 @@ static irqreturn_t renesas_i3c_start_isr(int irq, void *data)
scoped_guard(spinlock, &i3c->xferqueue.lock) {
xfer = i3c->xferqueue.cur;
if (!xfer) {
renesas_i3c_irqs_mask_and_clear_locked(i3c);
return IRQ_HANDLED;
}
cmd = xfer->cmds;
if (xfer->is_i2c_xfer) {