Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
mei: vsc: Event notifier fixes
vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex
to protect against this.
Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-7-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
authored by
Hans de Goede
and committed by
Greg Kroah-Hartman
18f14b2e
35b7f352
+9
-3
+9
-3
drivers/misc/mei/vsc-tp.c
+9
-3
drivers/misc/mei/vsc-tp.c
···
79
79
80
80
vsc_tp_event_cb_t event_notify;
81
81
void *event_notify_context;
82
-
83
-
/* used to protect command download */
84
-
struct mutex mutex;
82
+
struct mutex event_notify_mutex; /* protects event_notify + context */
83
+
struct mutex mutex; /* protects command download */
85
84
};
86
85
87
86
/* GPIO resources */
···
111
112
static irqreturn_t vsc_tp_thread_isr(int irq, void *data)
112
113
{
113
114
struct vsc_tp *tp = data;
115
+
116
+
guard(mutex)(&tp->event_notify_mutex);
114
117
115
118
if (tp->event_notify)
116
119
tp->event_notify(tp->event_notify_context);
···
400
399
int vsc_tp_register_event_cb(struct vsc_tp *tp, vsc_tp_event_cb_t event_cb,
401
400
void *context)
402
401
{
402
+
guard(mutex)(&tp->event_notify_mutex);
403
+
403
404
tp->event_notify = event_cb;
404
405
tp->event_notify_context = context;
405
406
···
502
499
return ret;
503
500
504
501
mutex_init(&tp->mutex);
502
+
mutex_init(&tp->event_notify_mutex);
505
503
506
504
/* only one child acpi device */
507
505
ret = acpi_dev_for_each_child(ACPI_COMPANION(dev),
···
527
523
err_destroy_lock:
528
524
free_irq(spi->irq, tp);
529
525
526
+
mutex_destroy(&tp->event_notify_mutex);
530
527
mutex_destroy(&tp->mutex);
531
528
532
529
return ret;
···
542
537
543
538
free_irq(spi->irq, tp);
544
539
540
+
mutex_destroy(&tp->event_notify_mutex);
545
541
mutex_destroy(&tp->mutex);
546
542
}
547
543