• Mark Hasemeyer's avatar
    spi: Fix null dereference on suspend · bef4a48f
    Mark Hasemeyer authored
    A race condition exists where a synchronous (noqueue) transfer can be
    active during a system suspend. This can cause a null pointer
    dereference exception to occur when the system resumes.
    
    Example order of events leading to the exception:
    1. spi_sync() calls __spi_transfer_message_noqueue() which sets
       ctlr->cur_msg
    2. Spi transfer begins via spi_transfer_one_message()
    3. System is suspended interrupting the transfer context
    4. System is resumed
    6. spi_controller_resume() calls spi_start_queue() which resets cur_msg
       to NULL
    7. Spi transfer context resumes and spi_finalize_current_message() is
       called which dereferences cur_msg (which is now NULL)
    
    Wait for synchronous transfers to complete before suspending by
    acquiring the bus mutex and setting/checking a suspend flag.
    Signed-off-by: default avatarMark Hasemeyer <markhas@chromium.org>
    Link: https://lore.kernel.org/r/20231107144743.v1.1.I7987f05f61901f567f7661763646cb7d7919b528@changeidSigned-off-by: default avatarMark Brown <broonie@kernel.org>
    Cc: stable@kernel.org
    bef4a48f
spi.c 124 KB