• Alex Smith's avatar
    mmc: jz4740: Fix race condition in IRQ mask update · a04f0017
    Alex Smith authored
    A spinlock is held while updating the internal copy of the IRQ mask,
    but not while writing it to the actual IMASK register. After the lock
    is released, an IRQ can occur before the IMASK register is written.
    If handling this IRQ causes the mask to be changed, when the handler
    returns back to the middle of the first mask update, a stale value
    will be written to the mask register.
    
    If this causes an IRQ to become unmasked that cannot have its status
    cleared by writing a 1 to it in the IREG register, e.g. the SDIO IRQ,
    then we can end up stuck with the same IRQ repeatedly being fired but
    not handled. Normally the MMC IRQ handler attempts to clear any
    unexpected IRQs by writing IREG, but for those that cannot be cleared
    in this way then the IRQ will just repeatedly fire.
    
    This was resulting in lockups after a while of using Wi-Fi on the
    CI20 (GitHub issue #19).
    
    Resolve by holding the spinlock until after the IMASK register has
    been updated.
    
    Cc: stable@vger.kernel.org
    Link: https://github.com/MIPS/CI20_linux/issues/19
    Fixes: 61bfbdb8 ("MMC: Add support for the controller on JZ4740 SoCs.")
    Tested-by: default avatarMathieu Malaterre <malat@debian.org>
    Signed-off-by: default avatarAlex Smith <alex.smith@imgtec.com>
    Signed-off-by: default avatarUlf Hansson <ulf.hansson@linaro.org>
    a04f0017
jz4740_mmc.c 27.1 KB