linux-stable.git/drivers/i2c, branch v3.16.40

i2c: core: fix NULL pointer dereference under race condition

2017-02-23T03:54:29+00:00

commit 147b36d5b70c083cc76770c47d60b347e8eaf231 upstream.

Race condition between registering an I2C device driver and
deregistering an I2C adapter device which is assumed to manage that
I2C device may lead to a NULL pointer dereference due to the
uninitialized list head of driver clients.

The root cause of the issue is that the I2C bus may know about the
registered device driver and thus it is matched by bus_for_each_drv(),
but the list of clients is not initialized and commonly it is NULL,
because I2C device drivers define struct i2c_driver as static and
clients field is expected to be initialized by I2C core:

  i2c_register_driver()             i2c_del_adapter()
    driver_register()                 ...
      bus_add_driver()                ...
        ...                           bus_for_each_drv(..., __process_removed_adapter)
      ...                               i2c_do_del_adapter()
    ...                                   list_for_each_entry_safe(..., &driver->clients, ...)
    INIT_LIST_HEAD(&driver->clients);

To solve the problem it is sufficient to do clients list head
initialization before calling driver_register().

The problem was found while using an I2C device driver with a sluggish
registration routine on a bus provided by a physically detachable I2C
master controller, but practically the oops may be reproduced under
the race between arbitraty I2C device driver registration and managing
I2C bus device removal e.g. by unbinding the latter over sysfs:

% echo 21a4000.i2c > /sys/bus/platform/drivers/imx-i2c/unbind
  Unable to handle kernel NULL pointer dereference at virtual address 00000000
  Internal error: Oops: 17 [#1] SMP ARM
  CPU: 2 PID: 533 Comm: sh Not tainted 4.9.0-rc3+ #61
  Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
  task: e5ada400 task.stack: e4936000
  PC is at i2c_do_del_adapter+0x20/0xcc
  LR is at __process_removed_adapter+0x14/0x1c
  Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
  Control: 10c5387d  Table: 35bd004a  DAC: 00000051
  Process sh (pid: 533, stack limit = 0xe4936210)
  Stack: (0xe4937d28 to 0xe4938000)
  Backtrace:
  [] (i2c_do_del_adapter) from [] (__process_removed_adapter+0x14/0x1c)
  [] (__process_removed_adapter) from [] (bus_for_each_drv+0x6c/0xa0)
  [] (bus_for_each_drv) from [] (i2c_del_adapter+0xbc/0x284)
  [] (i2c_del_adapter) from [] (i2c_imx_remove+0x44/0x164 [i2c_imx])
  [] (i2c_imx_remove [i2c_imx]) from [] (platform_drv_remove+0x2c/0x44)
  [] (platform_drv_remove) from [] (__device_release_driver+0x90/0x12c)
  [] (__device_release_driver) from [] (device_release_driver+0x28/0x34)
  [] (device_release_driver) from [] (unbind_store+0x80/0x104)
  [] (unbind_store) from [] (drv_attr_store+0x28/0x34)
  [] (drv_attr_store) from [] (sysfs_kf_write+0x50/0x54)
  [] (sysfs_kf_write) from [] (kernfs_fop_write+0x100/0x214)
  [] (kernfs_fop_write) from [] (__vfs_write+0x34/0x120)
  [] (__vfs_write) from [] (vfs_write+0xa8/0x170)
  [] (vfs_write) from [] (SyS_write+0x4c/0xa8)
  [] (SyS_write) from [] (ret_fast_syscall+0x0/0x1c)

Signed-off-by: Vladimir Zapolskiy 
Signed-off-by: Wolfram Sang 
Signed-off-by: Ben Hutchings

i2c: qup: skip qup_i2c_suspend if the device is already runtime suspended

2016-11-20T01:17:34+00:00

commit 331dcf421c34d227784d07943eb01e4023a42b0a upstream.

If the i2c device is already runtime suspended, if qup_i2c_suspend is
executed during suspend-to-idle or suspend-to-ram it will result in the
following splat:

WARNING: CPU: 3 PID: 1593 at drivers/clk/clk.c:476 clk_core_unprepare+0x80/0x90
Modules linked in:

CPU: 3 PID: 1593 Comm: bash Tainted: G        W       4.8.0-rc3 #14
Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
PC is at clk_core_unprepare+0x80/0x90
LR is at clk_unprepare+0x28/0x40
pc : [] lr : [] pstate: 60000145
Call trace:
 clk_core_unprepare+0x80/0x90
 qup_i2c_disable_clocks+0x2c/0x68
 qup_i2c_suspend+0x10/0x20
 platform_pm_suspend+0x24/0x68
 ...

This patch fixes the issue by executing qup_i2c_pm_suspend_runtime
conditionally in qup_i2c_suspend.

Signed-off-by: Sudeep Holla 
Reviewed-by: Andy Gross 
Signed-off-by: Wolfram Sang 
Signed-off-by: Ben Hutchings

i2c: mux: pca954x: retry updating the mux selection on failure

2016-11-20T01:17:34+00:00

commit 463e8f845cbf1c01e4cc8aeef1703212991d8e1e upstream.

The cached value of the last selected channel prevents retries on the
next call, even on failure to update the selected channel. Fix that.

Signed-off-by: Peter Rosin 
Signed-off-by: Wolfram Sang 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

i2c-eg20t: fix race between i2c init and interrupt enable

2016-11-20T01:17:33+00:00

commit 371a015344b6e270e7e3632107d9554ec6d27a6b upstream.

the eg20t driver call request_irq() function before the pch_base_address,
base address of i2c controller's register, is assigned an effective value.

there is one possible scenario that an interrupt which isn't inside eg20t
arrives immediately after request_irq() is executed when i2c controller
shares an interrupt number with others. since the interrupt handler
pch_i2c_handler() has already active as shared action, it will be called
and read its own register to determine if this interrupt is from itself.

At that moment, since base address of i2c registers is not remapped
in kernel space yet,so the INT handler will access an illegal address
and then a error occurs.

Signed-off-by: Yadi.hu 
Signed-off-by: Wolfram Sang 
Signed-off-by: Ben Hutchings

i2c: efm32: fix a failure path in efm32_i2c_probe()

2016-11-20T01:16:54+00:00

commit 7dd91d52a813f99a95d20f539b777e9e6198b931 upstream.

There is the only failure path in efm32_i2c_probe(),
where clk_disable_unprepare() is missed.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Acked-by: Uwe Kleine-König 
Signed-off-by: Wolfram Sang 
Fixes: 1b5b23718b84 ("i2c: efm32: new bus driver")
Signed-off-by: Ben Hutchings

i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared

2016-06-15T20:29:26+00:00

commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a upstream.

The exynos5 I2C controller driver always prepares and enables a clock
before using it and then disables unprepares it when the clock is not
used anymore.

But this can cause a possible ABBA deadlock in some scenarios since a
driver that uses regmap to access its I2C registers, will first grab
the regmap lock and then the I2C xfer function will grab the prepare
lock when preparing the I2C clock. But since the clock driver also
uses regmap for I2C accesses, preparing a clock will first grab the
prepare lock and then the regmap lock when using the regmap API.

An example of this happens on the Exynos5422 Odroid XU4 board where a
s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
share the same I2C regmap.

The possible deadlock is reported by the kernel lockdep:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(sec_core:428:(regmap)->lock);
                                lock(prepare_lock);
                                lock(sec_core:428:(regmap)->lock);
   lock(prepare_lock);

  *** DEADLOCK ***

Fix it by leaving the code prepared on probe and use {en,dis}able in
the I2C transfer function.

This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
deadlock by keeping clock prepared") that fixes the same bug in other
driver for an I2C controller found in Samsung SoCs.

Reported-by: Anand Moon 
Signed-off-by: Javier Martinez Canillas 
Reviewed-by: Anand Moon 
Reviewed-by: Krzysztof Kozlowski 
Signed-off-by: Wolfram Sang 
Signed-off-by: Ben Hutchings

i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs

2016-01-25T10:43:32+00:00

commit bba61f50f76574ca5b84b310925be7c2e8e64275 upstream.

According to the datasheets the n factor for dividing the tclk is
2 to the power n on Allwinner SoCs, not 2 to the power n + 1 as it is
on other mv64xxx implementations.

I've contacted Allwinner about this and they have confirmed that the
datasheet is correct.

This commit fixes the clk-divider calculations for Allwinner SoCs
accordingly.

Signed-off-by: Hans de Goede 
Acked-by: Maxime Ripard 
Tested-by: Olliver Schinagl 
Signed-off-by: Wolfram Sang 
Signed-off-by: Luis Henriques

i2c: mv64xxx: really allow I2C offloading

2015-11-16T11:27:12+00:00

commit 0729a04977d497cf66234fd7f900ddcec3ef1c52 upstream.

Commit 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix
several problems") completely reworked the offload support, but left a
debugging-related "return false" at the beginning of the
mv64xxx_i2c_can_offload() function. This has the unfortunate consequence
that offloading is in fact never used, which wasn't really the
intention.

This commit fixes that problem by removing the bogus "return false".

Fixes: 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix several problems")
Signed-off-by: Hezi Shahmoon 
[Thomas: reworked commit log and title.]
Signed-off-by: Thomas Petazzoni 
Signed-off-by: Wolfram Sang 
Signed-off-by: Luis Henriques

i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348

2015-11-16T11:26:51+00:00

commit 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 upstream.

ACPI SSCN/FMCN methods were originally added because then the platform can
provide the most accurate HCNT/LCNT values to the driver. However, this
seems not to be true for Dell Inspiron 7348 where using these causes the
touchpad to fail in boot:

  i2c_hid i2c-DLL0675:00: failed to retrieve report from device.
  i2c_designware INT3433:00: i2c_dw_handle_tx_abort: lost arbitration
  i2c_hid i2c-DLL0675:00: failed to retrieve report from device.
  i2c_designware INT3433:00: controller timed out

The values received from ACPI are (in fast mode):

  HCNT: 72
  LCNT: 160

this translates to following timings (input clock is 100MHz on Broadwell):

  tHIGH: 720 ns (spec min 600 ns)
  tLOW: 1600 ns (spec min 1300 ns)
  Bus period: 2920 ns (assuming 300 ns tf and tr)
  Bus speed: 342.5 kHz

Both tHIGH and tLOW are within the I2C specification.

The calculated values when ACPI parameters are not used are (in fast mode):

  HCNT: 87
  LCNT: 159

which translates to:

  tHIGH: 870 ns (spec min 600 ns)
  tLOW: 1590 ns (spec min 1300 ns)
  Bus period 3060 ns (assuming 300 ns tf and tr)
  Bus speed 326.8 kHz

These values are also within the I2C specification.

Since both ACPI and calculated values meet the I2C specification timing
requirements it is hard to say why the touchpad does not function properly
with the ACPI values except that the bus speed is higher in this case (but
still well below the max 400kHz).

Solve this by adding DMI quirk to the driver that disables using ACPI
parameters on this particulare machine.

Reported-by: Pavel Roskin 
Signed-off-by: Mika Westerberg 
Tested-by: Pavel Roskin 
Signed-off-by: Wolfram Sang 
Signed-off-by: Luis Henriques

i2c: designware-platdrv: enable RuntimePM before registering to the core

2015-11-16T11:26:51+00:00

commit 36d48fb5766aee9717e429f772046696b215282d upstream.

The core may register clients attached to this master which may use
funtionality from the master. So, RuntimePM must be enabled before, otherwise
this will fail.

Signed-off-by: Wolfram Sang 
Signed-off-by: Wolfram Sang 
Acked-by: Mika Westerberg 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques