Commit 3c13ab1d authored by Iago Abal's avatar Iago Abal Committed by Sebastian Reichel

HSI: cmt_speech: Fix double spin_lock

Release &hi->lock before calling `cs_hsi_control_read_error' to avoid deadlock.

The bug was found using EBA (https://github.com/models-team/eba), which reported
the following:

    Double lock
    first at drivers/hsi/clients/cmt_speech.c:443
    second at drivers/hsi/clients/cmt_speech.c:447
    In cs_hsi_read_on_control_complete defined at drivers/hsi/clients/cmt_speech.c:438:
    (!) drivers/hsi/clients/cmt_speech.c:443: spin_lock(& hi->lock);
    (?) drivers/hsi/clients/cmt_speech.c:445: msg->status == 4 -> true
    (!) drivers/hsi/clients/cmt_speech.c:447: cs_hsi_control_read_error(hi, msg);
        (!) drivers/hsi/clients/cmt_speech.c:407: __cs_hsi_error_pre(hi, msg, "control read",
                       & hi->control_state);
            (!) drivers/hsi/clients/cmt_speech.c:382: spin_lock(& hi->lock);
Signed-off-by: default avatarIago Abal <mail@iagoabal.eu>
Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
parent b32bd7e7
...@@ -444,8 +444,8 @@ static void cs_hsi_read_on_control_complete(struct hsi_msg *msg) ...@@ -444,8 +444,8 @@ static void cs_hsi_read_on_control_complete(struct hsi_msg *msg)
hi->control_state &= ~SSI_CHANNEL_STATE_READING; hi->control_state &= ~SSI_CHANNEL_STATE_READING;
if (msg->status == HSI_STATUS_ERROR) { if (msg->status == HSI_STATUS_ERROR) {
dev_err(&hi->cl->device, "Control RX error detected\n"); dev_err(&hi->cl->device, "Control RX error detected\n");
cs_hsi_control_read_error(hi, msg);
spin_unlock(&hi->lock); spin_unlock(&hi->lock);
cs_hsi_control_read_error(hi, msg);
goto out; goto out;
} }
dev_dbg(&hi->cl->device, "Read on control: %08X\n", cmd); dev_dbg(&hi->cl->device, "Read on control: %08X\n", cmd);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment