From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Qunqin Zhao <zhaoqunqin@loongson.cn>,
Yinggang Gu <guyinggang@loongson.cn>,
Huacai Chen <chenhuacai@kernel.org>,
linux-crypto@vger.kernel.org, mfd@lists.linux.dev,
linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH v2 17/27] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe
Date: Tue, 27 Oct 2026 09:30:46 +0000 [thread overview]
Message-ID: <20261027093306.2812695-18-lee@kernel.org> (raw)
In-Reply-To: <20261027093306.2812695-1-lee@kernel.org>
loongson_se_probe() allocates struct loongson_se using devm_kmalloc(),
leaving the se->engines array uninitialised until child MFD drivers
later invoke loongson_se_init_engine(). Meanwhile, hardware interrupts
are unmasked and se_irq_handler() is registered during probe. Any
engine interrupt arriving before loongson_se_init_engine() runs causes
se_irq_handler() to call complete() on an uninitialised completion
structure.
Allocate struct loongson_se with devm_kzalloc() and initialise all
engine completion structures in loongson_se_probe() before registering
interrupt handlers.
Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
Closes: https://sashiko.dev/#/bug/linux-ad9310d7-13b2-4a4a-ad7d-78a4c612c78c
Cc: stable@vger.kernel.org
Reviewed-by: Qunqin Zhao <zhaoqunqin@loongson.cn>
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/mfd/loongson-se.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
index 9b531e62fb85..187ebbed0422 100644
--- a/drivers/mfd/loongson-se.c
+++ b/drivers/mfd/loongson-se.c
@@ -106,7 +106,6 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
engine->se = se;
engine->id = id;
- init_completion(&engine->completion);
/* Divide DMA memory equally among all engines */
engine->buffer_size = se->dmam_size / SE_ENGINE_MAX;
@@ -199,12 +198,14 @@ static int loongson_se_probe(struct platform_device *pdev)
int nr_irq, irq, err, i;
dma_addr_t paddr;
- se = devm_kmalloc(dev, sizeof(*se), GFP_KERNEL);
+ se = devm_kzalloc(dev, sizeof(*se), GFP_KERNEL);
if (!se)
return -ENOMEM;
dev_set_drvdata(dev, se);
init_completion(&se->cmd_completion);
+ for (i = 0; i < SE_ENGINE_MAX; i++)
+ init_completion(&se->engines[i].completion);
spin_lock_init(&se->dev_lock);
mutex_init(&se->engine_init_lock);
--
2.56.0.307.g5fe7bd680c-goog
next prev parent reply other threads:[~2026-10-27 10:37 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 9:30 [PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes Lee Jones
2026-10-27 9:30 ` [PATCH v2 14/27] mfd: loongson-se: Check return value of dma_set_mask_and_coherent() Lee Jones
2026-10-27 9:30 ` [PATCH v2 15/27] mfd: loongson-se: Zero-initialise controller command structures Lee Jones
2026-10-27 9:30 ` [PATCH v2 16/27] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands Lee Jones
2026-10-27 9:30 ` Lee Jones [this message]
2026-10-27 9:30 ` [PATCH v2 18/27] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler() Lee Jones
2026-10-27 9:30 ` [PATCH v2 19/27] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown Lee Jones
2026-10-27 9:30 ` [PATCH v2 20/27] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027093306.2812695-18-lee@kernel.org \
--to=lee@kernel.org \
--cc=chenhuacai@kernel.org \
--cc=guyinggang@loongson.cn \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mfd@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=zhaoqunqin@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox