[PATCH] pinctrl: qcom: check the return value of qcom_scm_io_readl()

[PATCH] pinctrl: qcom: check the return value of qcom_scm_io_readl()

[Bartosz Golaszewski]

qcom_scm_io_readl() performs an SCM call and may fail in which case, the
stack variable val remains uninitialized and its contents are written to
HW registers. Check the return value and bail-out on failure.

Cc: stable@vger.kernel.org
Closes: https://sashiko.dev/#/bug/linux-a5545ffd-48cc-4856-94cc-4b2dd7968f50
Fixes: 13bec8d49bdf ("pinctrl: qcom: use scm_call to route GPIO irq to Apps")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
 drivers/pinctrl/qcom/pinctrl-msm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 32aa7b919e24a0e614078ddc70a248c746e4813b..0053d1d927dc134ee81377fe480befa2da87c7f5 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -1117,7 +1117,12 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)
 		u32 addr = pctrl->phys_base[0] + reg;
 		int ret;
 
-		qcom_scm_io_readl(addr, &val);
+		ret = qcom_scm_io_readl(addr, &val);
+		if (ret) {
+			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
+			return ret;
+		}
+
 		val &= ~(intr_target_mask << g->intr_target_bit);
 		val |= g->intr_target_kpss_val << g->intr_target_bit;
 

---
base-commit: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b
change-id: 20261105-pinctrl-qcom-scm-fail-3a5a2efa79e1

Best regards,
-- 
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH] pinctrl: qcom: check the return value of qcom_scm_io_readl()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pinctrl: qcom: premature dual_edge_irqs update in msm_gpio_irq_set_type()
--

commit 95e665aa134824797beb0596c04a8bbf7fde94f2
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

pinctrl: qcom: check the return value of qcom_scm_io_readl()

This commit checks the return value of qcom_scm_io_readl() in
msm_gpio_irq_set_type() and bails out on failure to avoid writing an
uninitialized value to hardware registers.

> diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
> index 32aa7b919e24a..0053d1d927dc1 100644
> --- a/drivers/pinctrl/qcom/pinctrl-msm.c
> +++ b/drivers/pinctrl/qcom/pinctrl-msm.c
> @@ -1117,7 +1117,12 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int type)
>  		u32 addr = pctrl->phys_base[0] + reg;
>  		int ret;
>  
> -		qcom_scm_io_readl(addr, &val);
> +		ret = qcom_scm_io_readl(addr, &val);
> +		if (ret) {
> +			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
> +			return ret;
> +		}

[Severity: Medium]
Just above this block in msm_gpio_irq_set_type(), pctrl->dual_edge_irqs is
updated for the new trigger type before qcom_scm_io_readl() is called:

	if (g->intr_detection_width == 1 && type == IRQ_TYPE_EDGE_BOTH)
		set_bit(d->hwirq, pctrl->dual_edge_irqs);
	else
		clear_bit(d->hwirq, pctrl->dual_edge_irqs);

On platforms like IPQ8064 where pctrl->intr_target_use_scm is set and
g->intr_detection_width is 1, if qcom_scm_io_readl() fails and returns early
here, msm_writel_intr_cfg() and msm_gpio_update_dual_edge_pos() are skipped
while pctrl->dual_edge_irqs retains the updated bit for the failed transition.

When __irq_set_trigger() then restores the IRQ state on error, wouldn't
pctrl->dual_edge_irqs be out of sync with the hardware interrupt configuration
inspected by msm_gpio_irq_ack()? Should the pctrl->dual_edge_irqs update be
moved after the qcom_scm_io_readl() check succeeds?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-pinctrl-qcom-scm-fail-v1-1-a23f96c6b313@oss.qualcomm.com?part=1