5f084993c9
commit 0686a818d77a431fc3ba2fab4b46bbb04e8c9380 upstream. A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. Cc: stable@vger.kernel.org # 6.8 Fixes: b89b6a863dd5 ("bus: mhi: host: Add spinlock to protect WP access when queueing TREs") Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Reviewed-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reviewed-by: Troy Hanson <quic_thanson@quicinc.com> Link: https://lore.kernel.org/r/20250306172913.856982-1-jeff.hugo@oss.qualcomm.com [mani: added stable tag] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| fsl-mc | ||
| mhi | ||
| arm-cci.c | ||
| arm-integrator-lm.c | ||
| brcmstb_gisb.c | ||
| bt1-apb.c | ||
| bt1-axi.c | ||
| da8xx-mstpri.c | ||
| hisi_lpc.c | ||
| imx-weim.c | ||
| intel-ixp4xx-eb.c | ||
| Kconfig | ||
| Makefile | ||
| mips_cdmm.c | ||
| moxtet.c | ||
| mvebu-mbus.c | ||
| omap_l3_noc.c | ||
| omap_l3_noc.h | ||
| omap_l3_smx.c | ||
| omap_l3_smx.h | ||
| omap-ocp2scp.c | ||
| qcom-ebi2.c | ||
| qcom-ssc-block-bus.c | ||
| simple-pm-bus.c | ||
| sun50i-de2.c | ||
| sunxi-rsb.c | ||
| tegra-aconnect.c | ||
| tegra-gmi.c | ||
| ti-pwmss.c | ||
| ti-sysc.c | ||
| ts-nbus.c | ||
| uniphier-system-bus.c | ||
| vexpress-config.c | ||