sugar/linux
1
0
Fork 0
Code Activity

mei: vsc: Event notifier fixes

Browse Source 
vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex
to protect against this.

Fixes: 566f5ca976 ("mei: Add transport driver for IVSC device")
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-7-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Hans de Goede
2025-06-23 10:50:48 +02:00
committed by Greg Kroah-Hartman
parent 35b7f3525f
commit 18f14b2e7f
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/misc/mei/vsc-tp.c
View File

@@ -79,9 +79,8 @@ struct vsc_tp {
vsc_tp_event_cb_t event_notify;
void *event_notify_context;
/* used to protect command download */
struct mutex mutex;
struct mutex event_notify_mutex; /* protects event_notify + context */
struct mutex mutex; /* protects command download */
};
/* GPIO resources */
@@ -113,6 +112,8 @@ static irqreturn_t vsc_tp_thread_isr(int irq, void *data)
{
struct vsc_tp *tp = data;
guard(mutex)(&tp->event_notify_mutex);
if (tp->event_notify)
tp->event_notify(tp->event_notify_context);
@@ -399,6 +400,8 @@ EXPORT_SYMBOL_NS_GPL(vsc_tp_need_read, "VSC_TP");
int vsc_tp_register_event_cb(struct vsc_tp *tp, vsc_tp_event_cb_t event_cb,
void *context)
{
guard(mutex)(&tp->event_notify_mutex);
tp->event_notify = event_cb;
tp->event_notify_context = context;
@@ -499,6 +502,7 @@ static int vsc_tp_probe(struct spi_device *spi)
return ret;
mutex_init(&tp->mutex);
mutex_init(&tp->event_notify_mutex);
/* only one child acpi device */
ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
@@ -523,6 +527,7 @@ static int vsc_tp_probe(struct spi_device *spi)
err_destroy_lock:
free_irq(spi->irq, tp);
mutex_destroy(&tp->event_notify_mutex);
mutex_destroy(&tp->mutex);
return ret;
@@ -537,6 +542,7 @@ static void vsc_tp_remove(struct spi_device *spi)
free_irq(spi->irq, tp);
mutex_destroy(&tp->event_notify_mutex);
mutex_destroy(&tp->mutex);
}