Skip to content
  • Lars-Peter Clausen's avatar
    iio: iio_push_event(): Don't crash if the event interface is not registered · 4b1a9380
    Lars-Peter Clausen authored
    
    
    iio_push_event() operates on a struct iio_dev. This struct can be allocated
    using iio_device_alloc() which returns a valid struct iio_dev pointer. But
    iio_push_event() is not safe to use on such a iio_dev until
    iio_device_register() for the same device has successfully completed.
    
    This restriction is not documented anywhere and most drivers are written
    with the assumption that this restriction does not exist. The basic pattern
    that is followed by all drivers looks like the following:
    
    	irqreturn_t event_callback(int irq, void *devid)
    	{
    		struct iio_dev *indio_dev = devid;
    		...
    		iio_push_event(indio_dev, ...);
    
    		return IRQ_HANDLED;
    	}
    
    	int driver_probe(struct device *dev)
    	{
    		struct iio_dev *indio_dev;
    
    		indio_dev = iio_device_alloc(...);
    
    		request_irq(event_irq, event_callback, ..., indio_dev);
    
    		return iio_device_register(indio_dev);
    	}
    
    And while it is unlikely that the IRQ fires before iio_device_register()
    completes (e.g. because the IRQ is disabled in the device) it is not
    impossible and might be triggered by glitches on the signal line or
    incorrect hardware configuration.
    
    To avoid undefined behaviour in such a case extend iio_push_event() to
    check if the event has been registered and discard generated events if it
    has not.
    
    Signed-off-by: default avatarLars-Peter Clausen <lars@metafoo.de>
    Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
    4b1a9380