Commit eebcc196 authored by Vivek Gautam's avatar Vivek Gautam Committed by Martin K. Petersen
Browse files

scsi: ufshcd: Fix NULL pointer dereference for in ufshcd_init 



Error paths in ufshcd_init() ufshcd_hba_exit() killed clk_scaling workqueue
when the workqueue is actually created quite late in ufshcd_init().  So, we
end up getting NULL pointer dereference in such error paths.  Fix this by
moving clk_scaling initialization and kill codes to two separate methods, and
call them at required places.

Fixes: 401f1e44 ("scsi: ufs: don't suspend clock scaling during clock
gating")

Signed-off-by: default avatarVivek Gautam <vivek.gautam@codeaurora.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: Subhash Jadavani <subhashj@codeaurora.org>
Cc: Matthias Kaehlcke <mka@chromium.org>
Cc: Evan Green <evgreen@chromium.org>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: default avatarEvan Green <evgreen@chromium.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 94e989de

drivers/scsi/ufs/ufshcd.c

+34 −19
Original line number Diff line number Diff line
@@ -1763,6 +1763,34 @@ out: 
	return count;

}



static void ufshcd_init_clk_scaling(struct ufs_hba *hba)

{

	char wq_name[sizeof("ufs_clkscaling_00")];



	if (!ufshcd_is_clkscaling_supported(hba))

		return;



	INIT_WORK(&hba->clk_scaling.suspend_work,

		  ufshcd_clk_scaling_suspend_work);

	INIT_WORK(&hba->clk_scaling.resume_work,

		  ufshcd_clk_scaling_resume_work);



	snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",

		 hba->host->host_no);

	hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);



	ufshcd_clkscaling_init_sysfs(hba);

}



static void ufshcd_exit_clk_scaling(struct ufs_hba *hba)

{

	if (!ufshcd_is_clkscaling_supported(hba))

		return;



	destroy_workqueue(hba->clk_scaling.workq);

	ufshcd_devfreq_remove(hba);

}



static void ufshcd_init_clk_gating(struct ufs_hba *hba)

{

	char wq_name[sizeof("ufs_clk_gating_00")];
@@ -6666,6 +6694,7 @@ out: 
	 */

	if (ret && !ufshcd_eh_in_progress(hba) && !hba->pm_op_in_progress) {

		pm_runtime_put_sync(hba->dev);

		ufshcd_exit_clk_scaling(hba);

		ufshcd_hba_exit(hba);

	}
@@ -7201,12 +7230,9 @@ static void ufshcd_hba_exit(struct ufs_hba *hba) 
		ufshcd_variant_hba_exit(hba);

		ufshcd_setup_vreg(hba, false);

		ufshcd_suspend_clkscaling(hba);

		if (ufshcd_is_clkscaling_supported(hba)) {

		if (ufshcd_is_clkscaling_supported(hba))

			if (hba->devfreq)

				ufshcd_suspend_clkscaling(hba);

			destroy_workqueue(hba->clk_scaling.workq);

			ufshcd_devfreq_remove(hba);

		}

		ufshcd_setup_clocks(hba, false);

		ufshcd_setup_hba_vreg(hba, false);

		hba->is_powered = false;
@@ -7881,6 +7907,7 @@ void ufshcd_remove(struct ufs_hba *hba) 
	ufshcd_disable_intr(hba, hba->intr_mask);

	ufshcd_hba_stop(hba, true);



	ufshcd_exit_clk_scaling(hba);

	ufshcd_exit_clk_gating(hba);

	if (ufshcd_is_clkscaling_supported(hba))

		device_remove_file(hba->dev, &hba->clk_scaling.enable_attr);
@@ -8045,6 +8072,8 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) 


	ufshcd_init_clk_gating(hba);



	ufshcd_init_clk_scaling(hba);



	/*

	 * In order to avoid any spurious interrupt immediately after

	 * registering UFS controller interrupt handler, clear any pending UFS
@@ -8083,21 +8112,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) 
		goto out_remove_scsi_host;

	}



	if (ufshcd_is_clkscaling_supported(hba)) {

		char wq_name[sizeof("ufs_clkscaling_00")];



		INIT_WORK(&hba->clk_scaling.suspend_work,

			  ufshcd_clk_scaling_suspend_work);

		INIT_WORK(&hba->clk_scaling.resume_work,

			  ufshcd_clk_scaling_resume_work);



		snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",

			 host->host_no);

		hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);



		ufshcd_clkscaling_init_sysfs(hba);

	}



	/*

	 * Set the default power management level for runtime and system PM.

	 * Default power saving mode is to keep UFS link in Hibern8 state
@@ -8135,6 +8149,7 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) 
out_remove_scsi_host:

	scsi_remove_host(hba->host);

exit_gating:

	ufshcd_exit_clk_scaling(hba);

	ufshcd_exit_clk_gating(hba);

out_disable:

	hba->is_irq_enabled = false;

CRA Git | Maintained and supported by SUSTech CRA and CCSE