| Message ID | 20221102161542.30669-1-sven@svenpeter.dev (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6d8fc203b28ff8f6115fbe5eaf584de8b824f4fa |
| Headers | show |
| Series | usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler | expand |
On Wed, 2 Nov 2022 at 16:24, Sven Peter <sven@svenpeter.dev> wrote: > > If reading TPS_REG_INT_EVENT1/2 fails in the interrupt handler event1 > and event2 may be uninitialized when they are used to determine > IRQ_HANDLED vs. IRQ_NONE in the error path. > > Fixes: c7260e29dd20 ("usb: typec: tipd: Add short-circuit for no irqs") > Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X") > Signed-off-by: Sven Peter <sven@svenpeter.dev> Reviewed-by: Eric Curtin <ecurtin@redhat.com> > --- > drivers/usb/typec/tipd/core.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c > index b637e8b378b3..2a77bab948f5 100644 > --- a/drivers/usb/typec/tipd/core.c > +++ b/drivers/usb/typec/tipd/core.c > @@ -474,7 +474,7 @@ static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status) > static irqreturn_t cd321x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event; > + u64 event = 0; > u32 status; > int ret; > > @@ -519,8 +519,8 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) > static irqreturn_t tps6598x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event1; > - u64 event2; > + u64 event1 = 0; > + u64 event2 = 0; > u32 status; > int ret; > > -- > 2.25.1 > >
Hi, On Wed, Nov 02, 2022 at 05:15:42PM +0100, Sven Peter wrote: > If reading TPS_REG_INT_EVENT1/2 fails in the interrupt handler event1 > and event2 may be uninitialized when they are used to determine > IRQ_HANDLED vs. IRQ_NONE in the error path. > > Fixes: c7260e29dd20 ("usb: typec: tipd: Add short-circuit for no irqs") > Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X") > Signed-off-by: Sven Peter <sven@svenpeter.dev> > --- > drivers/usb/typec/tipd/core.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c > index b637e8b378b3..2a77bab948f5 100644 > --- a/drivers/usb/typec/tipd/core.c > +++ b/drivers/usb/typec/tipd/core.c > @@ -474,7 +474,7 @@ static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status) > static irqreturn_t cd321x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event; > + u64 event = 0; > u32 status; > int ret; > > @@ -519,8 +519,8 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) > static irqreturn_t tps6598x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event1; > - u64 event2; > + u64 event1 = 0; > + u64 event2 = 0; > u32 status; > int ret; Reviewed-by: Guido Günther <agx@sigxcpu.org> Cheers, -- Guido
On Wed, Nov 02, 2022 at 05:15:42PM +0100, Sven Peter wrote: > If reading TPS_REG_INT_EVENT1/2 fails in the interrupt handler event1 > and event2 may be uninitialized when they are used to determine > IRQ_HANDLED vs. IRQ_NONE in the error path. > > Fixes: c7260e29dd20 ("usb: typec: tipd: Add short-circuit for no irqs") > Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X") > Signed-off-by: Sven Peter <sven@svenpeter.dev> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> > --- > drivers/usb/typec/tipd/core.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c > index b637e8b378b3..2a77bab948f5 100644 > --- a/drivers/usb/typec/tipd/core.c > +++ b/drivers/usb/typec/tipd/core.c > @@ -474,7 +474,7 @@ static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status) > static irqreturn_t cd321x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event; > + u64 event = 0; > u32 status; > int ret; > > @@ -519,8 +519,8 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) > static irqreturn_t tps6598x_interrupt(int irq, void *data) > { > struct tps6598x *tps = data; > - u64 event1; > - u64 event2; > + u64 event1 = 0; > + u64 event2 = 0; > u32 status; > int ret; > thanks,
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index b637e8b378b3..2a77bab948f5 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -474,7 +474,7 @@ static void tps6598x_handle_plug_event(struct tps6598x *tps, u32 status) static irqreturn_t cd321x_interrupt(int irq, void *data) { struct tps6598x *tps = data; - u64 event; + u64 event = 0; u32 status; int ret; @@ -519,8 +519,8 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) static irqreturn_t tps6598x_interrupt(int irq, void *data) { struct tps6598x *tps = data; - u64 event1; - u64 event2; + u64 event1 = 0; + u64 event2 = 0; u32 status; int ret;
If reading TPS_REG_INT_EVENT1/2 fails in the interrupt handler event1 and event2 may be uninitialized when they are used to determine IRQ_HANDLED vs. IRQ_NONE in the error path. Fixes: c7260e29dd20 ("usb: typec: tipd: Add short-circuit for no irqs") Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X") Signed-off-by: Sven Peter <sven@svenpeter.dev> --- drivers/usb/typec/tipd/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)