spmi: spmi-pmic-arb: Fix hw_irq overflow
Subsystems (3)
PATCH 1/1 spmi: spmi-pmic-arb: Fix hw_irq overflow
Currently, when handling the SPMI summary interrupt, the hw_irq number is calculated based on SID, Peripheral ID, IRQ index and APID. This is then passed to irq_find_mapping() to see if a mapping exists for this hw_irq and if available, invoke the interrupt handler. Since the IRQ index uses an "int" type, hw_irq which is of unsigned long data type can take a large value when SID has its MSB set to 1 and the type conversion happens. Because of this, irq_find_mapping() returns 0 as there is no mapping for this hw_irq. This ends up invoking cleanup_irq() as if the interrupt is spurious whereas it is actually a valid interrupt. Fix this by using the proper data type (u32) for id.
--- drivers/spmi/spmi-pmic-arb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/spmi/spmi-pmic-arb.c +2 -3
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved. +* Copyright (c) 2012-2015, 2017, 2021, The Linux Foundation. All rights reserved. */ #include <linux/bitmap.h> #include <linux/delay.h>
@@ -505,8 +505,7 @@ static void cleanup_irq(struct spmi_pmic_arb *pmic_arb, u16 apid, int id)static void periph_interrupt (struct spmi_pmic_arb *pmic_arb,u16 apid) {unsigned int irq; -u32 status; -int id; +u32 status, id;u8 sid = (pmic_arb->apid_data[apid].ppid >>8 ) &0xF ;u8 per = pmic_arb->apid_data[apid].ppid &0xFF ;
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
Quoting Subbaraman Narayanamurthy (2021-02-08 11:33:04)
Quoted 12 lines
Currently, when handling the SPMI summary interrupt, the
hw_irqnumber is calculated based on SID, Peripheral ID, IRQ index and APID. This is then passed toirq_find_mapping()to see if a mapping exists for thishw_irqand if available, invoke the interrupt handler. Since the IRQ index uses an "int" type,hw_irqwhich is of unsigned long data type can take a large value when SID has its MSB set to 1 and the type conversion happens. Because of this,irq_find_mapping()returns 0 as there is no mapping for thishw_irq. This ends up invokingcleanup_irq()as if the interrupt is spurious whereas it is actually a valid interrupt. Fix this by using the proper data type (u32) for id.
Quoted 3 lines
Signed-off-by Subbaraman Narayanamurthy <[email protected]>---
Applied to spmi-next
This patch was applied to qcom/linux.git (refs/heads/for-next):
Hello:
This patch was applied to qcom/linux.git (refs/heads/for-next):
Quoted 12 lines · On Mon, 8 Feb 2021 11:33:04 -0800 you wrote:
Currently, when handling the SPMI summary interrupt, the
hw_irqnumber is calculated based on SID, Peripheral ID, IRQ index and APID. This is then passed toirq_find_mapping()to see if a mapping exists for thishw_irqand if available, invoke the interrupt handler. Since the IRQ index uses an "int" type,hw_irqwhich is of unsigned long data type can take a large value when SID has its MSB set to 1 and the type conversion happens. Because of this,irq_find_mapping()returns 0 as there is no mapping for thishw_irq. This ends up invokingcleanup_irq()as if the interrupt is spurious whereas it is actually a valid interrupt. Fix this by using the proper data type (u32) for id.
Quoted 1 line
[...]
Here is the summary with links:
- spmi: spmi-pmic-arb: Fix hw_irq overflow
https://git.kernel.org/qcom/c/d19db80a3665
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html