From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
To: <vkoul@kernel.org>
Cc: <broonie@kernel.org>, <yung-chuan.liao@linux.intel.com>,
<pierre-louis.bossart@linux.dev>, <Basavaraj.Hiregoudar@amd.com>,
<Sunil-kumar.Dommati@amd.com>, <venkataprasad.potturu@amd.com>,
<Syed.SabaKareem@amd.com>, <Mario.Limonciello@amd.com>,
<Richard.Gong@amd.com>, <lee@kernel.org>, <Poojitha.N@amd.com>,
<linux-sound@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
"Vijendar Mukunda" <Vijendar.Mukunda@amd.com>
Subject: [PATCH v5 18/25] soundwire: amd: delay *sdw_ctx publication until after startup succeeds
Date: Sat, 7 Nov 2026 21:15:27 +0530 [thread overview]
Message-ID: <20261107154659.3358223-19-Vijendar.Mukunda@amd.com> (raw)
In-Reply-To: <20261107154659.3358223-1-Vijendar.Mukunda@amd.com>
sdw_amd_probe() published *sdw_ctx immediately after probe_controller()
returned, before sdw_amd_startup() ran. Two problems follow from this:
1. If sdw_amd_startup() fails, the error was returned directly, leaving
*sdw_ctx pointing to an allocated context whose platform devices were
already registered. The caller has no way to distinguish this from a
genuine probe success, so the context and devices leak.
2. A concurrent ACP IRQ handler on another CPU can read the non-NULL
adata->sdw pointer between the sdw_amd_exit() teardown and the
*sdw_ctx = NULL assignment, and dereference a freed context.
Fix both by using a local variable for the context, running
sdw_amd_startup() against it, and only writing *sdw_ctx after startup
succeeds. On failure sdw_amd_exit() is called on the local pointer and
the function returns without touching *sdw_ctx, so callers never observe
a partially-initialised or freed context.
Fixes: ed5e8741b8db ("soundwire: amd: refactor amd soundwire manager device node creation")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
---
drivers/soundwire/amd_init.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/soundwire/amd_init.c b/drivers/soundwire/amd_init.c
index 032697ea3590..ce40b1e5dbf3 100644
--- a/drivers/soundwire/amd_init.c
+++ b/drivers/soundwire/amd_init.c
@@ -176,11 +176,20 @@ static int sdw_amd_startup(struct sdw_amd_ctx *ctx)
int sdw_amd_probe(struct sdw_amd_res *res, struct sdw_amd_ctx **sdw_ctx)
{
- *sdw_ctx = sdw_amd_probe_controller(res);
- if (!*sdw_ctx)
+ struct sdw_amd_ctx *ctx;
+ int ret;
+
+ ctx = sdw_amd_probe_controller(res);
+ if (!ctx)
return -ENODEV;
- return sdw_amd_startup(*sdw_ctx);
+ ret = sdw_amd_startup(ctx);
+ if (ret) {
+ sdw_amd_exit(ctx);
+ return ret;
+ }
+ *sdw_ctx = ctx;
+ return 0;
}
EXPORT_SYMBOL_NS(sdw_amd_probe, "SOUNDWIRE_AMD_INIT");
--
2.53.0
next prev parent reply other threads:[~2026-11-07 15:49 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 15:45 [PATCH v5 00/25] soundwire: amd: SoundWire manager driver bug fixes Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 01/25] soundwire: amd: consolidate pad register macros into amd_init.h Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 02/25] soundwire: amd: program pad SCHMEN and OE control for ACP 7.0/7.1/7.2 Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 03/25] soundwire: amd: add pad ctrl helpers for D0/D3 PM transitions Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 04/25] soundwire: amd: track full pad teardown across suspend/resume Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 05/25] soundwire: amd: fix missing wake interrupt and group wake-arming calls in runtime suspend Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 06/25] soundwire: amd: fix IRQ thread dropping STATUS_0TO7 on simultaneous wake Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 07/25] soundwire: amd: remove STATUS_8TO11 clear from amd_sdw_process_wake_event() Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 08/25] soundwire: amd: fix missing wake interrupt for ACP6.3 in POWER_OFF suspend Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 09/25] soundwire: amd: fix SDW command timeout return value handling Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 10/25] soundwire: amd: return response on IMM status cleanup timeout Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 11/25] soundwire: amd: clarify bad-state guard poll omission in IMM_RES_VALID path Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 12/25] soundwire: amd: cache ping slave status to avoid spurious disconnect on timeout Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 13/25] soundwire: amd: assert msg_lock is held in amd_sdw_read_ping_status() Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 14/25] soundwire: amd: fix work drain ordering in remove path Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 15/25] soundwire: amd: defer dev_set_drvdata() until after INIT_WORK() Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 16/25] soundwire: amd: pm_runtime guard in remove path Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 17/25] soundwire: amd: use interrupt_enabled flag to guard IRQ work scheduling Vijendar Mukunda
2026-11-07 15:45 ` Vijendar Mukunda [this message]
2026-11-07 15:45 ` [PATCH v5 19/25] soundwire: amd: propagate amd_init_sdw_manager() error on resume Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 20/25] soundwire: amd: drop amd_deinit_sdw_manager() in POWER_OFF suspend Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 21/25] soundwire: amd: replace >= ACP70 with explicit switch/case in PM paths Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 22/25] soundwire: amd: fix interrupt gate and work drain ordering in PM ops Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 23/25] soundwire: amd: check for NULL manager drvdata in sdw_amd_startup() Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 24/25] soundwire: amd: fix shared-register RMW race in amd_sdw_set_device_state() Vijendar Mukunda
2026-11-07 15:45 ` [PATCH v5 25/25] soundwire: amd: fix shared-register RMW race in amd_sdw_host_wake_enable() Vijendar Mukunda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261107154659.3358223-19-Vijendar.Mukunda@amd.com \
--to=vijendar.mukunda@amd.com \
--cc=Basavaraj.Hiregoudar@amd.com \
--cc=Mario.Limonciello@amd.com \
--cc=Poojitha.N@amd.com \
--cc=Richard.Gong@amd.com \
--cc=Sunil-kumar.Dommati@amd.com \
--cc=Syed.SabaKareem@amd.com \
--cc=broonie@kernel.org \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=pierre-louis.bossart@linux.dev \
--cc=venkataprasad.potturu@amd.com \
--cc=vkoul@kernel.org \
--cc=yung-chuan.liao@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®