1. 28 May, 2021 1 commit
    • Krzysztof Kozlowski's avatar
      i2c: s3c2410: fix possible NULL pointer deref on read message after write · 24990423
      Krzysztof Kozlowski authored
      Interrupt handler processes multiple message write requests one after
      another, till the driver message queue is drained.  However if driver
      encounters a read message without preceding START, it stops the I2C
      transfer as it is an invalid condition for the controller.  At least the
      comment describes a requirement "the controller forces us to send a new
      START when we change direction".  This stop results in clearing the
      message queue (i2c->msg = NULL).
      
      The code however immediately jumped back to label "retry_write" which
      dereferenced the "i2c->msg" making it a possible NULL pointer
      dereference.
      
      The Coverity analysis:
      1. Condition !is_msgend(i2c), taking false branch.
         if (!is_msgend(i2c)) {
      
      2. Condition !is_lastmsg(i2c), taking true branch.
         } else if (!is_lastmsg(i2c)) {
      
      3. Condition i2c->msg->flags & 1, taking true branch.
         if (i2c->msg->flags & I2C_M_RD) {
      
      4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
         s3c24xx_i2c_stop(i2c, -EINVAL);
      
      5. Jumping to label retry_write.
         goto retry_write;
      
      6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
         if (!is_msgend(i2c)) {"
      
      All previous calls to s3c24xx_i2c_stop() in this interrupt service
      routine are followed by jumping to end of function (acknowledging
      the interrupt and returning).  This seems a reasonable choice also here
      since message buffer was entirely emptied.
      
      Addresses-Coverity: Explicit null dereferenced
      Fixes: 1da177e4
      
       ("Linux-2.6.12-rc2")
      Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
      Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
      24990423
  2. 16 Apr, 2021 1 commit
  3. 22 Jan, 2021 1 commit
  4. 11 Jun, 2020 1 commit
  5. 19 May, 2020 1 commit
  6. 24 Mar, 2020 1 commit
  7. 01 Aug, 2019 1 commit
  8. 12 Jun, 2019 1 commit
  9. 30 May, 2019 1 commit
    • Thomas Gleixner's avatar
      treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 · c942fddf
      Thomas Gleixner authored
      
      
      Based on 3 normalized pattern(s):
      
        this program is free software you can redistribute it and or modify
        it under the terms of the gnu general public license as published by
        the free software foundation either version 2 of the license or at
        your option any later version this program is distributed in the
        hope that it will be useful but without any warranty without even
        the implied warranty of merchantability or fitness for a particular
        purpose see the gnu general public license for more details
      
        this program is free software you can redistribute it and or modify
        it under the terms of the gnu general public license as published by
        the free software foundation either version 2 of the license or at
        your option any later version [author] [kishon] [vijay] [abraham]
        [i] [kishon]@[ti] [com] this program is distributed in the hope that
        it will be useful but without any warranty without even the implied
        warranty of merchantability or fitness for a particular purpose see
        the gnu general public license for more details
      
        this program is free software you can redistribute it and or modify
        it under the terms of the gnu general public license as published by
        the free software foundation either version 2 of the license or at
        your option any later version [author] [graeme] [gregory]
        [gg]@[slimlogic] [co] [uk] [author] [kishon] [vijay] [abraham] [i]
        [kishon]@[ti] [com] [based] [on] [twl6030]_[usb] [c] [author] [hema]
        [hk] [hemahk]@[ti] [com] this program is distributed in the hope
        that it will be useful but without any warranty without even the
        implied warranty of merchantability or fitness for a particular
        purpose see the gnu general public license for more details
      
      extracted by the scancode license scanner the SPDX license identifier
      
        GPL-2.0-or-later
      
      has been chosen to replace the boilerplate/reference in 1105 file(s).
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Reviewed-by: default avatarAllison Randal <allison@lohutok.net>
      Reviewed-by: default avatarRichard Fontana <rfontana@redhat.com>
      Reviewed-by: default avatarKate Stewart <kstewart@linuxfoundation.org>
      Cc: linux-spdx@vger.kernel.org
      Link: https://lkml.kernel.org/r/20190527070033.202006027@linutronix.de
      
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c942fddf
  10. 08 Jan, 2019 1 commit
  11. 12 Jul, 2018 1 commit
    • Peter Rosin's avatar
      i2c: remove i2c_lock_adapter and use i2c_lock_bus directly · 3f3a89e1
      Peter Rosin authored
      
      
      The i2c_lock_adapter name is ambiguous since it is unclear if it
      refers to the root adapter or the adapter you name in the argument.
      The natural interpretation is the adapter you name in the argument,
      but there are historical reasons for that not being the case; it
      in fact locks the root adapter. Just remove the function and force
      users to spell out the I2C_LOCK_ROOT_ADAPTER name to indicate what
      is really going on. Also remove i2c_unlock_adapter, of course.
      
      This patch was generated with
      
      git grep -l 'i2c_\(un\)\?lock_adapter' \
      | xargs sed -i 's/i2c_\(un\)\?lock_adapter(\([^)]*\))/'\
      'i2c_\1lock_bus(\2, I2C_LOCK_ROOT_ADAPTER)/g'
      
      followed by white-space touch-up.
      Signed-off-by: default avatarPeter Rosin <peda@axentia.se>
      Acked-by: default avatarJonathan Cameron <jonathan.cameron@huawei.com>
      Tested-by: default avatarSekhar Nori <nsekhar@ti.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      3f3a89e1
  12. 30 Apr, 2018 1 commit
  13. 31 Jul, 2017 1 commit
  14. 22 Aug, 2016 1 commit
  15. 25 Apr, 2016 5 commits
  16. 24 Apr, 2016 1 commit
  17. 10 Jan, 2016 1 commit
  18. 15 Oct, 2015 1 commit
  19. 12 May, 2015 2 commits
  20. 24 Jan, 2015 1 commit
    • Paul Osmialowski's avatar
      i2c: s3c2410: fix ABBA deadlock by keeping clock prepared · 34e81ad5
      Paul Osmialowski authored
      This patch solves deadlock between clock prepare mutex and regmap mutex reported
      by Tomasz Figa in [1] by implementing solution from [2]: "always leave the clock
      of the i2c controller in a prepared state".
      
      [1] https://lkml.org/lkml/2014/7/2/171
      [2] https://lkml.org/lkml/2014/7/2/207
      
      
      
      On each i2c transfer handled by s3c24xx_i2c_xfer(), clk_prepare_enable() was
      called, which calls clk_prepare() then clk_enable(). clk_prepare() takes
      prepare_lock mutex before proceeding. Note that i2c transfer functions are
      invoked from many places in kernel, typically with some other additional lock
      held.
      
      It may happen that function on CPU1 (e.g. regmap_update_bits()) has taken a
      mutex (i.e. regmap lock mutex) then it attempts i2c communication in order to
      proceed (so it needs to obtain clock related prepare_lock mutex during transfer
      preparation stage due to clk_prepare() call). At the same time other task on
      CPU0 wants to operate on clock (e.g. to (un)prepare clock for some other reason)
      so it has taken prepare_lock mutex.
      
      CPU0:                        CPU1:
      clk_disable_unused()         regulator_disable()
        clk_prepare_lock()           map->lock(map->lock_arg)
        regmap_read()                s3c24xx_i2c_xfer()
          map->lock(map->lock_arg)     clk_prepare_lock()
      
      Implemented solution from [2] leaves i2c clock prepared. Preparation is done in
      s3c24xx_i2c_probe() function. Without this patch, it is immediately unprepared
      by clk_disable_unprepare() call. I've replaced this call with clk_disable() and
      I've added clk_unprepare() call in s3c24xx_i2c_remove().
      
      The s3c24xx_i2c_xfer() function now uses clk_enable() instead of
      clk_prepare_enable() (and clk_disable() instead of clk_unprepare_disable()).
      Signed-off-by: default avatarPaul Osmialowski <p.osmialowsk@samsung.com>
      Reviewed-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      Cc: stable@kernel.org
      34e81ad5
  21. 24 Nov, 2014 1 commit
  22. 07 Nov, 2014 1 commit
  23. 20 Oct, 2014 1 commit
  24. 26 Aug, 2014 1 commit
  25. 01 Aug, 2014 1 commit
  26. 16 Jul, 2014 1 commit
  27. 02 Jun, 2014 1 commit
  28. 14 May, 2014 1 commit
  29. 12 Mar, 2014 2 commits
    • Simon Glass's avatar
      i2c: s3c2410: Leave the bus disabled unless it is in use · 069a9502
      Simon Glass authored
      
      
      There is a rather odd feature of the exynos i2c controller that if it
      is left enabled, it can lock itself up with the clk line held low.
      This makes the bus unusable.
      
      Unfortunately, the s3c24xx_i2c_set_master() function does not notice
      this, and reports a timeout. From then on the bus cannot be used until
      the AP is rebooted.
      
      The problem happens when any sort of interrupt occurs (e.g. due to a
      bus transition) when we are not in the middle of a transaction. We
      have seen many instances of this when U-Boot leaves the bus apparently
      happy, but Linux cannot access it.
      
      The current code is therefore pretty fragile.
      
      This fixes things by leaving the bus disabled unless we are actually
      in a transaction. We enable the bus at the start of the transaction and
      disable it at the end. That way we won't get interrupts and will not
      lock up the bus.
      
      It might be possible to clear pending interrupts on start-up, but this
      seems to be a more robust solution. We can't service interrupts when
      we are not in a transaction, and anyway would rather not lock up the
      bus while we try.
      Signed-off-by: default avatarSimon Glass <sjg@chromium.org>
      Signed-off-by: default avatarNaveen Krishna Chatradhi <ch.naveen@samsung.com>
      Acked-by: default avatarKyungmin Park <kyungmin.park@samsung.com>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      069a9502
    • Wolfram Sang's avatar
      i2c: i2c-s3c2410: deprecate class based instantiation · 5304032c
      Wolfram Sang authored
      
      
      Warn users that class based instantiation is going away soon in favour
      of more robust probing and faster bootup times.
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      Cc: Ben Dooks <ben-linux@fluff.org>
      Cc: Kukjin Kim <kgene.kim@samsung.com>
      5304032c
  30. 16 Jan, 2014 1 commit
  31. 03 Jan, 2014 2 commits
  32. 30 Oct, 2013 1 commit
  33. 27 Sep, 2013 1 commit
    • Kim Phillips's avatar
      i2c: s3c2410: fix clk_disable/clk_unprepare WARNings · 15336913
      Kim Phillips authored
      commit d16933b3
      
       "i2c: s3c2410: Move
      location of clk_prepare_enable() call in probe function" refactored
      clk_enable and clk_disable calls yet neglected to remove the
      clk_disable_unprepare call in the module's remove().
      
      It helps remove warnings on an arndale during unbind:
      
      echo 12c90000.i2c > /sys/bus/platform/devices/12c90000.i2c/driver/unbind
      
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:842 clk_disable+0x18/0x24()
      Modules linked in:
      CPU: 0 PID: 2548 Comm: bash Not tainted 3.11.0-next-20130916-00003-gf4bddbc #6
      [<c0014d48>] (unwind_backtrace+0x0/0xf8) from [<c00117d0>] (show_stack+0x10/0x14)
      [<c00117d0>] (show_stack+0x10/0x14) from [<c0361be8>] (dump_stack+0x6c/0xac)
      [<c0361be8>] (dump_stack+0x6c/0xac) from [<c001d864>] (warn_slowpath_common+0x64/0x88)
      [<c001d864>] (warn_slowpath_common+0x64/0x88) from [<c001d8a4>] (warn_slowpath_null+0x1c/0x24)
      [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) from [<c02c4a64>] (clk_disable+0x18/0x24)
      [<c02c4a64>] (clk_disable+0x18/0x24) from [<c028d0b0>] (s3c24xx_i2c_remove+0x28/0x70)
      [<c028d0b0>] (s3c24xx_i2c_remove+0x28/0x70) from [<c0217a10>] (platform_drv_remove+0x18/0x1c)
      [<c0217a10>] (platform_drv_remove+0x18/0x1c) from [<c0216358>] (__device_release_driver+0x58/0xb4)
      [<c0216358>] (__device_release_driver+0x58/0xb4) from [<c02163d0>] (device_release_driver+0x1c/0x28)
      [<c02163d0>] (device_release_driver+0x1c/0x28) from [<c02153c0>] (unbind_store+0x58/0x90)
      [<c02153c0>] (unbind_store+0x58/0x90) from [<c0214c90>] (drv_attr_store+0x20/0x2c)
      [<c0214c90>] (drv_attr_store+0x20/0x2c) from [<c01032c0>] (sysfs_write_file+0x168/0x198)
      [<c01032c0>] (sysfs_write_file+0x168/0x198) from [<c00ae1c0>] (vfs_write+0xb0/0x194)
      [<c00ae1c0>] (vfs_write+0xb0/0x194) from [<c00ae594>] (SyS_write+0x3c/0x70)
      [<c00ae594>] (SyS_write+0x3c/0x70) from [<c000e3e0>] (ret_fast_syscall+0x0/0x30)
      ---[ end trace 4c9f9403066f57a6 ]---
      ------------[ cut here ]------------
      WARNING: CPU: 0 PID: 2548 at drivers/clk/clk.c:751 clk_unprepare+0x14/0x1c()
      Modules linked in:
      CPU: 0 PID: 2548 Comm: bash Tainted: G        W    3.11.0-next-20130916-00003-gf4bddbc #6
      [<c0014d48>] (unwind_backtrace+0x0/0xf8) from [<c00117d0>] (show_stack+0x10/0x14)
      [<c00117d0>] (show_stack+0x10/0x14) from [<c0361be8>] (dump_stack+0x6c/0xac)
      [<c0361be8>] (dump_stack+0x6c/0xac) from [<c001d864>] (warn_slowpath_common+0x64/0x88)
      [<c001d864>] (warn_slowpath_common+0x64/0x88) from [<c001d8a4>] (warn_slowpath_null+0x1c/0x24)
      [<c001d8a4>] (warn_slowpath_null+0x1c/0x24) from [<c02c5834>] (clk_unprepare+0x14/0x1c)
      [<c02c5834>] (clk_unprepare+0x14/0x1c) from [<c028d0b8>] (s3c24xx_i2c_remove+0x30/0x70)
      [<c028d0b8>] (s3c24xx_i2c_remove+0x30/0x70) from [<c0217a10>] (platform_drv_remove+0x18/0x1c)
      [<c0217a10>] (platform_drv_remove+0x18/0x1c) from [<c0216358>] (__device_release_driver+0x58/0xb4)
      [<c0216358>] (__device_release_driver+0x58/0xb4) from [<c02163d0>] (device_release_driver+0x1c/0x28)
      [<c02163d0>] (device_release_driver+0x1c/0x28) from [<c02153c0>] (unbind_store+0x58/0x90)
      [<c02153c0>] (unbind_store+0x58/0x90) from [<c0214c90>] (drv_attr_store+0x20/0x2c)
      [<c0214c90>] (drv_attr_store+0x20/0x2c) from [<c01032c0>] (sysfs_write_file+0x168/0x198)
      [<c01032c0>] (sysfs_write_file+0x168/0x198) from [<c00ae1c0>] (vfs_write+0xb0/0x194)
      [<c00ae1c0>] (vfs_write+0xb0/0x194) from [<c00ae594>] (SyS_write+0x3c/0x70)
      [<c00ae594>] (SyS_write+0x3c/0x70) from [<c000e3e0>] (ret_fast_syscall+0x0/0x30)
      ---[ end trace 4c9f9403066f57a7 ]---
      Signed-off-by: default avatarKim Phillips <kim.phillips@linaro.org>
      Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
      15336913