mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 10:09:10 +02:00
10dd1a736d
A severe livelock and subsequent Hung Task panic were observed in the
i2c-i801 driver during concurrent Fuzzing. The crash is caused by an
unconditional hardware register cleanup in the error handling path of
i801_access().
When i801_check_pre() fails (e.g., returning -EBUSY because the SMBus
controller is actively used by BIOS/ACPI), the kernel does not actually
acquire the hardware ownership. However, the code jumps to the 'out'
label and executes:
iowrite8(SMBHSTSTS_INUSE_STS | STATUS_FLAGS, SMBHSTSTS(priv));
This forcefully clears the INUSE_STS lock and resets the hardware status
flags without owning the controller. Doing so interrupts ongoing BIOS/ACPI
transactions and totally corrupts the SMBus hardware state machine.
Consequently, all subsequent i801_access() calls fail at the pre-check
stage, triggering an endless stream of "SMBus is busy, can't use it!"
error logs. Over a slow serial console, this printk flood monopolizes
the CPU (Console Livelock), starving other processes trying to acquire
the mmap_lock down_read semaphore, ultimately triggering the hung task
watchdog.
Fix this by moving the 'out' label below the hardware register cleanup.
If i801_check_pre() fails, we safely bypass the iowrite8() and only
release the software locks (pm_runtime and mutex), strictly adhering to
the rule of not releasing resources that were never acquired.
Fixes:
|
||
|---|---|---|
| .. | ||
| algos | ||
| busses | ||
| muxes | ||
| i2c-atr.c | ||
| i2c-boardinfo.c | ||
| i2c-core-acpi.c | ||
| i2c-core-base.c | ||
| i2c-core-of-prober.c | ||
| i2c-core-of.c | ||
| i2c-core-slave.c | ||
| i2c-core-smbus.c | ||
| i2c-core.h | ||
| i2c-dev.c | ||
| i2c-mux.c | ||
| i2c-slave-eeprom.c | ||
| i2c-slave-testunit.c | ||
| i2c-smbus.c | ||
| i2c-stub.c | ||
| Kconfig | ||
| Makefile | ||