linux-kernel - [PATCH 7/7] Bluetooth: btmtksdio: mask out interrupt status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a8fb77540e15a0c042fdfa338bee32e992aaafc9.1641972745.git.objelf@gmail.com>
Date:   Wed, 12 Jan 2022 15:39:17 +0800
From:   <sean.wang@...iatek.com>
To:     <marcel@...tmann.org>, <johan.hedberg@...il.com>
CC:     <Mark-YW.Chen@...iatek.com>, <sean.wang@...iatek.com>,
        <Soul.Huang@...iatek.com>, <YN.Chen@...iatek.com>,
        <Leon.Yen@...iatek.com>, <Eric-SY.Chang@...iatek.com>,
        <Deren.Wu@...iatek.com>, <km.lin@...iatek.com>,
        <robin.chiu@...iatek.com>, <Eddie.Chen@...iatek.com>,
        <ch.yeh@...iatek.com>, <posh.sun@...iatek.com>,
        <ted.huang@...iatek.com>, <Eric.Liang@...iatek.com>,
        <Stella.Chang@...iatek.com>, <Tom.Chou@...iatek.com>,
        <steve.lee@...iatek.com>, <jsiuda@...gle.com>,
        <frankgor@...gle.com>, <jemele@...gle.com>,
        <abhishekpandit@...gle.com>, <michaelfsun@...gle.com>,
        <mcchou@...omium.org>, <shawnku@...gle.com>,
        <linux-bluetooth@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
Subject: [PATCH 7/7] Bluetooth: btmtksdio: mask out interrupt status

From: Sean Wang <sean.wang@...iatek.com>

Currently, there is a loop in btmtksdio_txrx_work() which iteratively
executes until the variable int_status is zero.

But the variable int_status should be masked out with the actual interrupt
sources (MTK_REG_CHISR bit 0-15) before we check the loop condition.
Otherwise, RX_PKT_LEN (MTK_REG_CHISR bit 16-31) which is read-only and
unclearable would cause the loop to get stuck on some chipsets like
MT7663s.

Fixes: 26270bc189ea ("Bluetooth: btmtksdio: move interrupt service to work")
Signed-off-by: Sean Wang <sean.wang@...iatek.com>
---
 drivers/bluetooth/btmtksdio.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index 491f029452ca..8be763ab3bf4 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -92,6 +92,7 @@ MODULE_DEVICE_TABLE(sdio, btmtksdio_table);
 #define TX_EMPTY		BIT(2)
 #define TX_FIFO_OVERFLOW	BIT(8)
 #define FW_MAILBOX_INT		BIT(15)
+#define INT_MASK		GENMASK(15, 0)
 #define RX_PKT_LEN		GENMASK(31, 16)
 
 #define MTK_REG_CSICR		0xc0
@@ -565,6 +566,7 @@ static void btmtksdio_txrx_work(struct work_struct *work)
 		 * FIFO.
 		 */
 		sdio_writel(bdev->func, int_status, MTK_REG_CHISR, NULL);
+		int_status &= INT_MASK;
 
 		if ((int_status & FW_MAILBOX_INT) &&
 		    bdev->data->chipid == 0x7921) {
-- 
2.25.1