Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2256893ybg; Sun, 27 Oct 2019 14:32:24 -0700 (PDT) X-Google-Smtp-Source: APXvYqyYdQr8jmyropeYE8ybdzjNyBzWDxiVnoBKd0k3s9Dy+2whu3W13v5rpAgD0He/XLf5dUTP X-Received: by 2002:a05:6402:689:: with SMTP id f9mr13864688edy.79.1572211944519; Sun, 27 Oct 2019 14:32:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572211944; cv=none; d=google.com; s=arc-20160816; b=Xj4FY8/8edAmNp6i2QELO5wGsH2bpXOk7tFuHuOr+5VAtp4tkeHoAn0egAMJDYWk4P nv3LWFYV5HiFSuAeFLQqD6htEF+90ULYcbbm7H5201TFTq2Ps2AVfPsOCKR5Lv2h5/zx PKrJrS70lQ4YZnQnFZckrOrXv8KT9UnUB6HEhsKXpz6u2r6nwd+XbXrxeSiPOIBTfpiv AtEkGDMQPLESdfLnAWr7uck9sEnhCZ+FuzyxSLb7WnYXkhPmiKd4FUbbqDuQeDKQJ+qP jim4X/GQACU54TVfmvck/3q0XIBI+PHHyWKkslXzYqGA/mGSxCvtDzneAhOqiBManKue uEgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=F4nbXwjNxy701k4wKwZDhuUO9R5KzYiZ45rGQp0Kd7w=; b=vDarHhNZiZ5dRloMbnb3Lq1AH00BJGx6TmGgWjYeGbE9Q/zGp+LTZ5mkvUks7x2Y7l k+vOZ/QoowDPR5kArPUTIhZHRt9kclDZmWbWJVIO3BQsrehLraxAWIhgUE1UJTb6FdKl pJAx1SPt7RQXoGF0C3C6FDoLhl+/e9uWkNpG+A9ZOSXgzEegcQdTXP0MvDW5WXtFzzaj oaUua/1fcHHrcgcdovm2/pZaLw2DFYMjw4BIsLaMDZ9mrRrKPqjkK4SyjqPdBMBK6apQ b3q0IInFRexI1PfLZ9U7C7ACsWEAzoezOrv1qof1fnjsNNeSVMZELXB8LTW0lox0k6Tv MMgw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=SREKlXSR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d6si5991156ede.119.2019.10.27.14.32.01; Sun, 27 Oct 2019 14:32:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=SREKlXSR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731486AbfJ0VW0 (ORCPT + 99 others); Sun, 27 Oct 2019 17:22:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:43376 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732124AbfJ0VWW (ORCPT ); Sun, 27 Oct 2019 17:22:22 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4A708208C0; Sun, 27 Oct 2019 21:22:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572211340; bh=JdEx2XorxiF5emEMUubrlBRegU0owdRivo+wfot7gtU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SREKlXSR8ei/2ayHuEl93qCcXIAdS9018bh/ucM9VQBgpdv+QRcTczQReTwQjtrpM QFYfpP4h/ACUHfylWsfiOgQP6mDkANfRJV0Eg2lSX+9/EQ/1AZe1c94HrW4KCvaGTj 7xqp4D57QUo5HnFt0fAqebtKGbumlXHTV0Tdxcr8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evan Green , Andrew Duggan , Dmitry Torokhov Subject: [PATCH 5.3 116/197] Input: synaptics-rmi4 - avoid processing unknown IRQs Date: Sun, 27 Oct 2019 22:00:34 +0100 Message-Id: <20191027203358.000247480@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203351.684916567@linuxfoundation.org> References: <20191027203351.684916567@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Evan Green commit 363c53875aef8fce69d4a2d0873919ccc7d9e2ad upstream. rmi_process_interrupt_requests() calls handle_nested_irq() for each interrupt status bit it finds. If the irq domain mapping for this bit had not yet been set up, then it ends up calling handle_nested_irq(0), which causes a NULL pointer dereference. There's already code that masks the irq_status bits coming out of the hardware with current_irq_mask, presumably to avoid this situation. However current_irq_mask seems to more reflect the actual mask set in the hardware rather than the IRQs software has set up and registered for. For example, in rmi_driver_reset_handler(), the current_irq_mask is initialized based on what is read from the hardware. If the reset value of this mask enables IRQs that Linux has not set up yet, then we end up in this situation. There appears to be a third unused bitmask that used to serve this purpose, fn_irq_bits. Use that bitmask instead of current_irq_mask to avoid calling handle_nested_irq() on IRQs that have not yet been set up. Signed-off-by: Evan Green Reviewed-by: Andrew Duggan Link: https://lore.kernel.org/r/20191008223657.163366-1-evgreen@chromium.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman --- drivers/input/rmi4/rmi_driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/input/rmi4/rmi_driver.c +++ b/drivers/input/rmi4/rmi_driver.c @@ -146,7 +146,7 @@ static int rmi_process_interrupt_request } mutex_lock(&data->irq_mutex); - bitmap_and(data->irq_status, data->irq_status, data->current_irq_mask, + bitmap_and(data->irq_status, data->irq_status, data->fn_irq_bits, data->irq_count); /* * At this point, irq_status has all bits that are set in the @@ -385,6 +385,8 @@ static int rmi_driver_set_irq_bits(struc bitmap_copy(data->current_irq_mask, data->new_irq_mask, data->num_of_irq_regs); + bitmap_or(data->fn_irq_bits, data->fn_irq_bits, mask, data->irq_count); + error_unlock: mutex_unlock(&data->irq_mutex); return error; @@ -398,6 +400,8 @@ static int rmi_driver_clear_irq_bits(str struct device *dev = &rmi_dev->dev; mutex_lock(&data->irq_mutex); + bitmap_andnot(data->fn_irq_bits, + data->fn_irq_bits, mask, data->irq_count); bitmap_andnot(data->new_irq_mask, data->current_irq_mask, mask, data->irq_count);