* [PATCH AUTOSEL 5.15 23/68] HID: ft260: fix i2c probing for hwmon devices
[not found] <20211130144707.944580-1-sashal@kernel.org>
@ 2021-11-30 14:46 ` Sasha Levin
2021-11-30 14:46 ` [PATCH AUTOSEL 5.15 35/68] i2c: i801: Fix interrupt storm from SMB_ALERT signal Sasha Levin
1 sibling, 0 replies; 3+ messages in thread
From: Sasha Levin @ 2021-11-30 14:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Zaidman, Germain Hebert, Jiri Kosina, Sasha Levin, jikos,
benjamin.tissoires, linux-i2c, linux-input
From: Michael Zaidman <michael.zaidman@gmail.com>
[ Upstream commit a94f61e63f337d95001e1a976ab701100fa1d666 ]
The below scenario causes the kernel NULL pointer dereference failure:
1. sudo insmod hid-ft260.ko
2. sudo modprobe lm75
3. unplug USB hid-ft260
4. plug USB hid-ft260
[ +0.000006] Call Trace:
[ +0.000004] __i2c_smbus_xfer.part.0+0xd1/0x310
[ +0.000007] ? ft260_smbus_write+0x140/0x140 [hid_ft260]
[ +0.000005] __i2c_smbus_xfer+0x2b/0x80
[ +0.000004] i2c_smbus_xfer+0x61/0xf0
[ +0.000005] i2c_default_probe+0xf9/0x130
[ +0.000004] i2c_detect_address+0x84/0x160
[ +0.000004] ? kmem_cache_alloc_trace+0xf6/0x200
[ +0.000009] ? i2c_detect.isra.0+0x69/0x130
[ +0.000005] i2c_detect.isra.0+0xbf/0x130
[ +0.000004] ? __process_new_driver+0x30/0x30
[ +0.000004] __process_new_adapter+0x18/0x20
[ +0.000004] bus_for_each_drv+0x84/0xd0
[ +0.000003] i2c_register_adapter+0x1e4/0x400
[ +0.000005] i2c_add_adapter+0x5c/0x80
[ +0.000004] ft260_probe.cold+0x222/0x2e2 [hid_ft260]
[ +0.000006] hid_device_probe+0x10e/0x170 [hid]
[ +0.000009] really_probe+0xff/0x460
[ +0.000004] driver_probe_device+0xe9/0x160
[ +0.000003] __device_attach_driver+0x71/0xd0
[ +0.000004] ? driver_allows_async_probing+0x50/0x50
[ +0.000004] bus_for_each_drv+0x84/0xd0
[ +0.000002] __device_attach+0xde/0x1e0
[ +0.000004] device_initial_probe+0x13/0x20
[ +0.000004] bus_probe_device+0x8f/0xa0
[ +0.000003] device_add+0x333/0x5f0
It happened when i2c core probed for the devices associated with the lm75
driver by invoking 2c_detect()-->..-->ft260_smbus_write() from within the
ft260_probe before setting the adapter data with i2c_set_adapdata().
Moving the i2c_set_adapdata() before i2c_add_adapter() fixed the failure.
Signed-off-by: Michael Zaidman <michael.zaidman@gmail.com>
Signed-off-by: Germain Hebert <germain.hebert@ca.abb.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ft260.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/hid-ft260.c b/drivers/hid/hid-ft260.c
index 4ef1c3b8094ea..8ee77f4afe9ff 100644
--- a/drivers/hid/hid-ft260.c
+++ b/drivers/hid/hid-ft260.c
@@ -966,24 +966,23 @@ static int ft260_probe(struct hid_device *hdev, const struct hid_device_id *id)
mutex_init(&dev->lock);
init_completion(&dev->wait);
+ ret = ft260_xfer_status(dev);
+ if (ret)
+ ft260_i2c_reset(hdev);
+
+ i2c_set_adapdata(&dev->adap, dev);
ret = i2c_add_adapter(&dev->adap);
if (ret) {
hid_err(hdev, "failed to add i2c adapter\n");
goto err_hid_close;
}
- i2c_set_adapdata(&dev->adap, dev);
-
ret = sysfs_create_group(&hdev->dev.kobj, &ft260_attr_group);
if (ret < 0) {
hid_err(hdev, "failed to create sysfs attrs\n");
goto err_i2c_free;
}
- ret = ft260_xfer_status(dev);
- if (ret)
- ft260_i2c_reset(hdev);
-
return 0;
err_i2c_free:
--
2.33.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH AUTOSEL 5.15 35/68] i2c: i801: Fix interrupt storm from SMB_ALERT signal
[not found] <20211130144707.944580-1-sashal@kernel.org>
2021-11-30 14:46 ` [PATCH AUTOSEL 5.15 23/68] HID: ft260: fix i2c probing for hwmon devices Sasha Levin
@ 2021-11-30 14:46 ` Sasha Levin
2021-12-03 8:30 ` Jean Delvare
1 sibling, 1 reply; 3+ messages in thread
From: Sasha Levin @ 2021-11-30 14:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jarkko Nikula, ck+kernelbugzilla, stephane.poignant, Jean Delvare,
Wolfram Sang, Sasha Levin, jdelvare, linux-i2c
From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
[ Upstream commit 03a976c9afb5e3c4f8260c6c08a27d723b279c92 ]
Currently interrupt storm will occur from i2c-i801 after first
transaction if SMB_ALERT signal is enabled and ever asserted. It is
enough if the signal is asserted once even before the driver is loaded
and does not recover because that interrupt is not acknowledged.
This fix aims to fix it by two ways:
- Add acknowledging for the SMB_ALERT interrupt status
- Disable the SMB_ALERT interrupt on platforms where possible since the
driver currently does not make use for it
Acknowledging resets the SMB_ALERT interrupt status on all platforms and
also should help to avoid interrupt storm on older platforms where the
SMB_ALERT interrupt disabling is not available.
For simplicity this fix reuses the host notify feature for disabling and
restoring original register value.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=177311
Reported-by: ck+kernelbugzilla@bl4ckb0x.de
Reported-by: stephane.poignant@protonmail.com
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Reviewed-by: Jean Delvare <jdelvare@suse.de>
Tested-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-i801.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 1f929e6c30bea..9be0b8f3e4a54 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -190,6 +190,7 @@
#define SMBSLVSTS_HST_NTFY_STS BIT(0)
/* Host Notify Command register bits */
+#define SMBSLVCMD_SMBALERT_DISABLE BIT(2)
#define SMBSLVCMD_HST_NTFY_INTREN BIT(0)
#define STATUS_ERROR_FLAGS (SMBHSTSTS_FAILED | SMBHSTSTS_BUS_ERR | \
@@ -639,12 +640,20 @@ static irqreturn_t i801_isr(int irq, void *dev_id)
i801_isr_byte_done(priv);
/*
- * Clear irq sources and report transaction result.
+ * Clear remaining IRQ sources: Completion of last command, errors
+ * and the SMB_ALERT signal. SMB_ALERT status is set after signal
+ * assertion independently of the interrupt generation being blocked
+ * or not so clear it always when the status is set.
+ */
+ status &= SMBHSTSTS_INTR | STATUS_ERROR_FLAGS | SMBHSTSTS_SMBALERT_STS;
+ if (status)
+ outb_p(status, SMBHSTSTS(priv));
+ status &= ~SMBHSTSTS_SMBALERT_STS; /* SMB_ALERT not reported */
+ /*
+ * Report transaction result.
* ->status must be cleared before the next transaction is started.
*/
- status &= SMBHSTSTS_INTR | STATUS_ERROR_FLAGS;
if (status) {
- outb_p(status, SMBHSTSTS(priv));
priv->status = status;
complete(&priv->done);
}
@@ -972,9 +981,13 @@ static void i801_enable_host_notify(struct i2c_adapter *adapter)
if (!(priv->features & FEATURE_HOST_NOTIFY))
return;
- if (!(SMBSLVCMD_HST_NTFY_INTREN & priv->original_slvcmd))
- outb_p(SMBSLVCMD_HST_NTFY_INTREN | priv->original_slvcmd,
- SMBSLVCMD(priv));
+ /*
+ * Enable host notify interrupt and block the generation of interrupt
+ * from the SMB_ALERT signal because the driver does not support
+ * SMBus Alert.
+ */
+ outb_p(SMBSLVCMD_HST_NTFY_INTREN | SMBSLVCMD_SMBALERT_DISABLE |
+ priv->original_slvcmd, SMBSLVCMD(priv));
/* clear Host Notify bit to allow a new notification */
outb_p(SMBSLVSTS_HST_NTFY_STS, SMBSLVSTS(priv));
--
2.33.0
^ permalink raw reply related [flat|nested] 3+ messages in thread