363c53875a
rmi_process_interrupt_requests() calls handle_nested_irq() for each interrupt status bit it finds. If the irq domain mapping for this bit had not yet been set up, then it ends up calling handle_nested_irq(0), which causes a NULL pointer dereference. There's already code that masks the irq_status bits coming out of the hardware with current_irq_mask, presumably to avoid this situation. However current_irq_mask seems to more reflect the actual mask set in the hardware rather than the IRQs software has set up and registered for. For example, in rmi_driver_reset_handler(), the current_irq_mask is initialized based on what is read from the hardware. If the reset value of this mask enables IRQs that Linux has not set up yet, then we end up in this situation. There appears to be a third unused bitmask that used to serve this purpose, fn_irq_bits. Use that bitmask instead of current_irq_mask to avoid calling handle_nested_irq() on IRQs that have not yet been set up. Signed-off-by: Evan Green <evgreen@chromium.org> Reviewed-by: Andrew Duggan <aduggan@synaptics.com> Link: https://lore.kernel.org/r/20191008223657.163366-1-evgreen@chromium.org Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| rmi_2d_sensor.c | ||
| rmi_2d_sensor.h | ||
| rmi_bus.c | ||
| rmi_bus.h | ||
| rmi_driver.c | ||
| rmi_driver.h | ||
| rmi_f01.c | ||
| rmi_f03.c | ||
| rmi_f11.c | ||
| rmi_f12.c | ||
| rmi_f30.c | ||
| rmi_f34.c | ||
| rmi_f34.h | ||
| rmi_f34v7.c | ||
| rmi_f54.c | ||
| rmi_f55.c | ||
| rmi_i2c.c | ||
| rmi_smbus.c | ||
| rmi_spi.c | ||