netdev - [PATCH] net: qrtr: mhi: make it work again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 29 Aug 2021 15:45:28 +0300
From:   Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To:     Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>,
        "David S. Miller" <davem@...emloft.net>
Cc:     linux-arm-msm@...r.kernel.org, netdev@...r.kernel.org
Subject: [PATCH] net: qrtr: mhi: make it work again

The commit ce78ffa3ef16 ("net: really fix the build...") introduced two
issues into the mhi.c driver:
 - use of initialized completion
 - calling mhi_prepare_for_transfer twice

While the first one is pretty obvious, the second one makes all devices
using mhi.c to return -EINVAL during probe. Fist
mhi_prepare_for_transfer() would change both channels state to ENABLED.
Then when second mhi_prepare_for_transfer() would be called it would
also try switching them to ENABLED again, which is forbidden by the
state machine in the mhi_update_channel_state() function (see
drivers/bus/mhi/core/main.c).
These two issues make all drivers using qcom_mhi_qrtr (e.g. ath11k) to
fail with -EINVAL.

Fix them by removing first mhi_prepare_for_transfer() call and by adding
the init_completion() call.

Fixes: ce78ffa3ef16 ("net: really fix the build...")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
---
 net/qrtr/mhi.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/net/qrtr/mhi.c b/net/qrtr/mhi.c
index 1dc955ca57d3..f3f4a5fdeaf3 100644
--- a/net/qrtr/mhi.c
+++ b/net/qrtr/mhi.c
@@ -83,15 +83,12 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
 	struct qrtr_mhi_dev *qdev;
 	int rc;

-	/* start channels */
-	rc = mhi_prepare_for_transfer(mhi_dev, 0);
-	if (rc)
-		return rc;
-
 	qdev = devm_kzalloc(&mhi_dev->dev, sizeof(*qdev), GFP_KERNEL);
 	if (!qdev)
 		return -ENOMEM;

+	init_completion(&qdev->ready);
+
 	qdev->mhi_dev = mhi_dev;
 	qdev->dev = &mhi_dev->dev;
 	qdev->ep.xmit = qcom_mhi_qrtr_send;
-- 
2.33.0