Revision bba676cc0b6122a74fa2e246f38a6b05c6f95b36 authored by Dhananjay Phadke on 05 August 2021, 21:49:05 UTC, committed by Wolfram Sang on 10 August 2021, 20:40:55 UTC
Similar NULL deref was originally fixed by graceful teardown sequence - https://lore.kernel.org/linux-i2c/1597106560-79693-1-git-send-email-dphadke@linux.microsoft.com After this, a tasklet was added to take care of FIFO full condition for large i2c transaction. https://lore.kernel.org/linux-arm-kernel/20201102035433.6774-1-rayagonda.kokatanur@broadcom.com/ This introduced regression, a new race condition between tasklet enabling interrupts and client unreg teardown sequence. Kill tasklet before unreg_slave() masks bits in IE_OFFSET. Updated teardown sequence - (1) disable_irq() (2) Kill tasklet (3) Mask event enable bits in control reg (4) Erase slave address (avoid further writes to rx fifo) (5) Flush tx and rx FIFOs (6) Clear pending event (interrupt) bits in status reg (7) Set client pointer to NULL (8) enable_irq() -- Unable to handle kernel read from unreadable memory at virtual address 0000000000000320 Mem abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000009212a000 [0000000000000320] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] SMP CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O Hardware name: Overlake (DT) pstate: 40400085 (nZcv daIf +PAN -UAO -TCO BTYPE=--) pc : bcm_iproc_i2c_slave_isr+0x2b8/0x8e4 lr : bcm_iproc_i2c_slave_isr+0x1c8/0x8e4 sp : ffff800010003e70 x29: ffff800010003e80 x28: ffffda017acdc000 x27: ffffda017b0ae000 x26: ffff800010004000 x25: ffff800010000000 x24: ffffda017af4a168 x23: 0000000000000073 x22: 0000000000000000 x21: 0000000001400000 x20: 0000000001000000 x19: ffff06f09583f880 x18: 00000000fa83b2da x17: 000000000000b67e x16: 0000000002edb2f3 x15: 00000000000002c7 x14: 00000000000002c7 x13: 0000000000000006 x12: 0000000000000033 x11: 0000000000000000 x10: 0000000001000000 x9 : 0000000003289312 x8 : 0000000003289311 x7 : 02d0cd03a303adbc x6 : 02d18e7f0a4dfc6c x5 : 02edb2f33f76ea68 x4 : 00000000fa83b2da x3 : ffffda017af43cd0 x2 : ffff800010003e74 x1 : 0000000001400000 x0 : 0000000000000000 Call trace: bcm_iproc_i2c_slave_isr+0x2b8/0x8e4 bcm_iproc_i2c_isr+0x178/0x290 __handle_irq_event_percpu+0xd0/0x200 handle_irq_event+0x60/0x1a0 handle_fasteoi_irq+0x130/0x220 __handle_domain_irq+0x8c/0xcc gic_handle_irq+0xc0/0x120 el1_irq+0xcc/0x180 finish_task_switch+0x100/0x1d8 __schedule+0x61c/0x7a0 schedule_idle+0x28/0x44 do_idle+0x254/0x28c cpu_startup_entry+0x28/0x2c rest_init+0xc4/0xd0 arch_call_rest_init+0x14/0x1c start_kernel+0x33c/0x3b8 Code: f9423260 910013e2 11000509 b9047a69 (f9419009) ---[ end trace 4781455b2a7bec15 ]--- Fixes: 4d658451c9d6 ("i2c: iproc: handle rx fifo full interrupt") Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com> Acked-by: Ray Jui <ray.jui@broadcom.com> Acked-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com> Signed-off-by: Wolfram Sang <wsa@kernel.org>
1 parent 36a21d5
Kconfig
# SPDX-License-Identifier: GPL-2.0
if RALINK
config CLKEVT_RT3352
bool
depends on SOC_RT305X || SOC_MT7620
default y
select TIMER_OF
select CLKSRC_MMIO
config RALINK_ILL_ACC
bool
depends on SOC_RT305X
default y
config IRQ_INTC
bool
default y
depends on !SOC_MT7621
choice
prompt "Ralink SoC selection"
default SOC_RT305X
help
Select Ralink MIPS SoC type.
config SOC_RT288X
bool "RT288x"
select MIPS_AUTO_PFN_OFFSET
select MIPS_L1_CACHE_SHIFT_4
select HAVE_PCI
config SOC_RT305X
bool "RT305x"
config SOC_RT3883
bool "RT3883"
select HAVE_PCI
config SOC_MT7620
bool "MT7620/8"
select CPU_MIPSR2_IRQ_VI
select HAVE_PCI
config SOC_MT7621
bool "MT7621"
select MIPS_CPU_SCACHE
select SYS_SUPPORTS_MULTITHREADING
select SYS_SUPPORTS_SMP
select SYS_SUPPORTS_MIPS_CPS
select SYS_SUPPORTS_HIGHMEM
select MIPS_GIC
select CLKSRC_MIPS_GIC
select HAVE_PCI if PCI_MT7621
select SOC_BUS
endchoice
choice
prompt "Devicetree selection"
default DTB_RT_NONE
help
Select the devicetree.
config DTB_RT_NONE
bool "None"
config DTB_RT2880_EVAL
bool "RT2880 eval kit"
depends on SOC_RT288X
select BUILTIN_DTB
config DTB_RT305X_EVAL
bool "RT305x eval kit"
depends on SOC_RT305X
select BUILTIN_DTB
config DTB_RT3883_EVAL
bool "RT3883 eval kit"
depends on SOC_RT3883
select BUILTIN_DTB
config DTB_MT7620A_EVAL
bool "MT7620A eval kit"
depends on SOC_MT7620
select BUILTIN_DTB
config DTB_OMEGA2P
bool "Onion Omega2+"
depends on SOC_MT7620
select BUILTIN_DTB
config DTB_VOCORE2
bool "VoCore2"
depends on SOC_MT7620
select BUILTIN_DTB
endchoice
endif
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...