linux-kernel - Re: Nokia N900 - audio TPA6130A2 problems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Mar 2016 15:47:10 +0100
From:	Sebastian Reichel <sre@...nel.org>
To:	Pali Rohár <pali.rohar@...il.com>
Cc:	Peter Ujfalusi <peter.ujfalusi@...com>,
	Jarkko Nikula <jarkko.nikula@...mer.com>,
	Tony Lindgren <tony@...mide.com>,
	Lars-Peter Clausen <lars@...afoo.de>,
	linux-kernel@...r.kernel.org, linux-omap@...r.kernel.org,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>,
	Nishanth Menon <nm@...com>,
	Ivaylo Dimitrov <ivo.g.dimitrov.75@...il.com>,
	merlijn@...zup.org
Subject: Re: Nokia N900 - audio TPA6130A2 problems

Hi,

On Wed, Mar 16, 2016 at 02:33:19PM +0100, Pali Rohár wrote:
> Hi! We found out that tpa6130a2 device is being initialized before
> i2c_2 bus is initialized. So that is reason why tpa6130a2 fails...

What do you mean by initialize? A call to tpa6130a2_probe()? In that
case I wonder about client->adapter. Is it NULL?

> Any idea why kernel first try to initialize one i2c device even before
> bus itself is initialized?

Just dump the stack during the tpa6130a2 initialization and you can
see it in the kernel log:

dump_stack();

---------------

I just had another look at the driver and I think there is a race
condition for tpa6130a2_add_controls() and tpa6130a2_stereo_enable().

As far as I can see both functions check for "tpa6130a2_client !=
NULL". tpa6130a2_client is set before the probe function has finished,
though. Simplified probe:

...
tpa6130a2_client = client;
set_default_regs();
acquire_power_gpio();
acquire_regulator();
tpa6130a2_power(1); // needs tpa6130a2_client
check_device();
tpa6130a2_power(0); // needs tpa6130a2_client
...

If tpa6130a2_add_controls() or tpa6130a2_stereo_enable() is called
after tpa6130a2 probe has started, but before probe has completed,
tpa6130a2_client is set, but not yet initialized. The race condition
can be fixed easily by moving the tpa6130a2_client assignment directly
after the regulator acquisition.

-- Sebastian

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)