bus: mhi: core: Handle disable transitions in state worker

Mission mode transition is handled by state worker thread but
power off is not. There is a possibility while mission mode
transition is in progress which calls MHI client driver probe,
power off is issued by MHI controller. This results into client
driver probe and remove running in parallel and causes use after
free situation. By queuing disable transition work when mission
mode is in progress prevents the race condition.

Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20200521170249.21795-11-manivannan.sadhasivam@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
index 3a853c5d21035aa782b576cad9606f62c4f676bb..12207cc438aa7899910985d9fdfdb7cfc239ee0e 100644 (file)
--- a/drivers/bus/mhi/core/init.c
+++ b/drivers/bus/mhi/core/init.c
@@ -35,6 +35,7 @@ const char * const dev_state_tran_str[DEV_ST_TRANSITION_MAX] = {
        [DEV_ST_TRANSITION_SBL] = "SBL",
        [DEV_ST_TRANSITION_MISSION_MODE] = "MISSION_MODE",
        [DEV_ST_TRANSITION_SYS_ERR] = "SYS_ERR",
+       [DEV_ST_TRANSITION_DISABLE] = "DISABLE",
 };
 
 const char * const mhi_state_str[MHI_STATE_MAX] = {

diff --git a/drivers/bus/mhi/core/internal.h b/drivers/bus/mhi/core/internal.h
index f01283b8a4510255b45dde2668260bd5049629ae..b1f640b75a94bb2d449977d68629d84f092aa41c 100644 (file)
--- a/drivers/bus/mhi/core/internal.h
+++ b/drivers/bus/mhi/core/internal.h
@@ -387,6 +387,7 @@ enum dev_st_transition {
        DEV_ST_TRANSITION_SBL,
        DEV_ST_TRANSITION_MISSION_MODE,
        DEV_ST_TRANSITION_SYS_ERR,
+       DEV_ST_TRANSITION_DISABLE,
        DEV_ST_TRANSITION_MAX,
 };
 

diff --git a/drivers/bus/mhi/core/pm.c b/drivers/bus/mhi/core/pm.c
index d9964d4c4eeda1da3c5b1aa055718e2c00f45cd4..345f197130b8a9c674e236e49de16908739361bd 100644 (file)
--- a/drivers/bus/mhi/core/pm.c
+++ b/drivers/bus/mhi/core/pm.c
@@ -657,6 +657,10 @@ void mhi_pm_st_worker(struct work_struct *work)
                        mhi_pm_disable_transition
                                (mhi_cntrl, MHI_PM_SYS_ERR_PROCESS);
                        break;
+               case DEV_ST_TRANSITION_DISABLE:
+                       mhi_pm_disable_transition
+                               (mhi_cntrl, MHI_PM_SHUTDOWN_PROCESS);
+                       break;
                default:
                        break;
                }
@@ -1011,7 +1015,12 @@ void mhi_power_down(struct mhi_controller *mhi_cntrl, bool graceful)
                                to_mhi_pm_state_str(MHI_PM_LD_ERR_FATAL_DETECT),
                                to_mhi_pm_state_str(mhi_cntrl->pm_state));
        }
-       mhi_pm_disable_transition(mhi_cntrl, MHI_PM_SHUTDOWN_PROCESS);
+
+       mhi_queue_state_transition(mhi_cntrl, DEV_ST_TRANSITION_DISABLE);
+
+       /* Wait for shutdown to complete */
+       flush_work(&mhi_cntrl->st_worker);
+
        mhi_deinit_free_irq(mhi_cntrl);
 
        if (!mhi_cntrl->pre_init) {