From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D1F2C43381 for ; Wed, 27 Mar 2019 18:50:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 359262082F for ; Wed, 27 Mar 2019 18:50:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553712602; bh=LvLKoPMWKuLlrz0K3rjLUwBtbKSrMaa6v0Vn/KQONoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=b7Kxw8iIejJMQP/xWBRd1/shVieCsT6orcaOBzE7YzLz8ABxNoUqwHEcwCG0/0sP5 MYhnQNZdFKIAJRJTQQ4JLKxYTq6Nw6Phz1OIlGQKYDSPWLpNk+jQzSIeXeMJHd4HT2 aNDfnWU65mhVDYJly09zxz95fWU3fmFJ90AvtOXQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390512AbfC0SSY (ORCPT ); Wed, 27 Mar 2019 14:18:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:35268 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390491AbfC0SSX (ORCPT ); Wed, 27 Mar 2019 14:18:23 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5F21320449; Wed, 27 Mar 2019 18:18:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553710702; bh=LvLKoPMWKuLlrz0K3rjLUwBtbKSrMaa6v0Vn/KQONoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=033PxYWxDPmdoWDmuu9g9EjvDoJgRpNaLoQb403j5pawi2O5VZspeAXiqJR8YS9On XuIv3l0VG1uTMXdrmS/3Q3yqC+3MkutF9JQ7nYxloGgn3E9fQZcZ4hM17KkXHBTG/n V843UHUY8tGG4XUftm2lW5H9fPYKsTNTyu68U3yA= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Hong Liu , Jiri Kosina , Sasha Levin , linux-input@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 063/123] HID: intel-ish-hid: avoid binding wrong ishtp_cl_device Date: Wed, 27 Mar 2019 14:15:27 -0400 Message-Id: <20190327181628.15899-63-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190327181628.15899-1-sashal@kernel.org> References: <20190327181628.15899-1-sashal@kernel.org> MIME-Version: 1.0 X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Hong Liu [ Upstream commit 0d28f49412405d87d3aae83da255070a46e67627 ] When performing a warm reset in ishtp bus driver, the ishtp_cl_device will not be removed, its fw_client still points to the already freed ishtp_device.fw_clients array. Later after driver finishing ishtp client enumeration, this dangling pointer may cause driver to bind the wrong ishtp_cl_device to the new client, causing wrong callback to be called for messages intended for the new client. This helps in development of firmware where frequent switching of firmwares is required without Linux reboot. Signed-off-by: Hong Liu Tested-by: Hongyan Song Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin --- drivers/hid/intel-ish-hid/ishtp/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c index 2623a567ffba..f546635e9ac9 100644 --- a/drivers/hid/intel-ish-hid/ishtp/bus.c +++ b/drivers/hid/intel-ish-hid/ishtp/bus.c @@ -623,7 +623,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl) spin_lock_irqsave(&cl->dev->device_list_lock, flags); list_for_each_entry(cl_device, &cl->dev->device_list, device_link) { - if (cl_device->fw_client->client_id == cl->fw_client_id) { + if (cl_device->fw_client && + cl_device->fw_client->client_id == cl->fw_client_id) { cl->device = cl_device; rv = 0; break; @@ -683,6 +684,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device *ishtp_dev, spin_lock_irqsave(&ishtp_dev->device_list_lock, flags); list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list, device_link) { + cl_device->fw_client = NULL; if (warm_reset && cl_device->reference_count) continue; -- 2.19.1