| Message ID | 20241202135708.26219-1-quic_vtanuku@quicinc.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v1,RESEND] slimbus: messaging: Free transaction ID in delayed interrupt scenario | expand |
On 02/12/2024 13:57, Visweswara Tanuku wrote: > In case of interrupt delay for any reason, slim_do_transfer() > returns timeout error but the transaction ID (TID) is not freed. > This results into invalid memory access inside > qcom_slim_ngd_rx_msgq_cb() due to invalid TID. > > Fix the issue by freeing the TID in slim_do_transfer() before > returning timeout error to avoid invalid memory access. > > Call trace: > __memcpy_fromio+0x20/0x190 > qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] > vchan_complete+0x2a0/0x4a0 > tasklet_action_common+0x274/0x700 > tasklet_action+0x28/0x3c > _stext+0x188/0x620 > run_ksoftirqd+0x34/0x74 > smpboot_thread_fn+0x1d8/0x464 > kthread+0x178/0x238 > ret_from_fork+0x10/0x20 > Code: aa0003e8 91000429 f100044a 3940002b (3800150b) > ---[ end trace 0fe00bec2b975c99 ]--- > Kernel panic - not syncing: Oops: Fatal exception in interrupt. > Missing Fixes and Stable tag. --srini > Signed-off-by: Visweswara Tanuku <quic_vtanuku@quicinc.com> > --- > drivers/slimbus/messaging.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c > index 242570a5e565..455c1fd1490f 100644 > --- a/drivers/slimbus/messaging.c > +++ b/drivers/slimbus/messaging.c > @@ -148,8 +148,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) > } > > ret = ctrl->xfer_msg(ctrl, txn); > - > - if (!ret && need_tid && !txn->msg->comp) { > + if (ret == -ETIMEDOUT) { > + slim_free_txn_tid(ctrl, txn); > + } else if (!ret && need_tid && !txn->msg->comp) { > unsigned long ms = txn->rl + HZ; > > time_left = wait_for_completion_timeout(txn->comp,
diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index 242570a5e565..455c1fd1490f 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -148,8 +148,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; time_left = wait_for_completion_timeout(txn->comp,
In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Signed-off-by: Visweswara Tanuku <quic_vtanuku@quicinc.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)