5.15-stable patchesHEADmaster

added patches:
	hid-i2c-hid-remove-i2c_hid_read_pending-flag-to-prevent-lock-up.patch

2 files changed, 76 insertions, 0 deletions

diff --git a/queue-5.15/hid-i2c-hid-remove-i2c_hid_read_pending-flag-to-prevent-lock-up.patch b/queue-5.15/hid-i2c-hid-remove-i2c_hid_read_pending-flag-to-prevent-lock-up.patch
new file mode 100644
index 0000000000..791d2a3f46
--- /dev/null
+++ b/queue-5.15/hid-i2c-hid-remove-i2c_hid_read_pending-flag-to-prevent-lock-up.patch
@@ -0,0 +1,75 @@
+From 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e Mon Sep 17 00:00:00 2001
+From: Nam Cao <namcao@linutronix.de>
+Date: Mon, 18 Mar 2024 11:59:02 +0100
+Subject: HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
+
+From: Nam Cao <namcao@linutronix.de>
+
+commit 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e upstream.
+
+The flag I2C_HID_READ_PENDING is used to serialize I2C operations.
+However, this is not necessary, because I2C core already has its own
+locking for that.
+
+More importantly, this flag can cause a lock-up: if the flag is set in
+i2c_hid_xfer() and an interrupt happens, the interrupt handler
+(i2c_hid_irq) will check this flag and return immediately without doing
+anything, then the interrupt handler will be invoked again in an
+infinite loop.
+
+Since interrupt handler is an RT task, it takes over the CPU and the
+flag-clearing task never gets scheduled, thus we have a lock-up.
+
+Delete this unnecessary flag.
+
+Reported-and-tested-by: Eva Kurchatova <nyandarknessgirl@gmail.com>
+Closes: https://lore.kernel.org/r/CA+eeCSPUDpUg76ZO8dszSbAGn+UHjcyv8F1J-CUPVARAzEtW9w@mail.gmail.com
+Fixes: 4a200c3b9a40 ("HID: i2c-hid: introduce HID over i2c specification implementation")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+[apply to v4.19 -> v5.15]
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-core.c |    8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -51,7 +51,6 @@
+ /* flags */
+ #define I2C_HID_STARTED		0
+ #define I2C_HID_RESET_PENDING	1
+-#define I2C_HID_READ_PENDING	2
+ 
+ #define I2C_HID_PWR_ON		0x00
+ #define I2C_HID_PWR_SLEEP	0x01
+@@ -251,7 +250,6 @@ static int __i2c_hid_command(struct i2c_
+ 		msg[1].len = data_len;
+ 		msg[1].buf = buf_recv;
+ 		msg_num = 2;
+-		set_bit(I2C_HID_READ_PENDING, &ihid->flags);
+ 	}
+ 
+ 	if (wait)
+@@ -259,9 +257,6 @@ static int __i2c_hid_command(struct i2c_
+ 
+ 	ret = i2c_transfer(client->adapter, msg, msg_num);
+ 
+-	if (data_len > 0)
+-		clear_bit(I2C_HID_READ_PENDING, &ihid->flags);
+-
+ 	if (ret != msg_num)
+ 		return ret < 0 ? ret : -EIO;
+ 
+@@ -533,9 +528,6 @@ static irqreturn_t i2c_hid_irq(int irq,
+ {
+ 	struct i2c_hid *ihid = dev_id;
+ 
+-	if (test_bit(I2C_HID_READ_PENDING, &ihid->flags))
+-		return IRQ_HANDLED;
+-
+ 	i2c_hid_get_input(ihid);
+ 
+ 	return IRQ_HANDLED;
diff --git a/queue-5.15/series b/queue-5.15/series
index 6515931549..c444fabc6f 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -74,3 +74,4 @@ riscv-fix-vmalloc_start-definition.patch
 riscv-fix-task_size-on-64-bit-nommu.patch
 i2c-smbus-fix-null-function-pointer-dereference.patch
 fbdev-fix-incorrect-address-computation-in-deferred-io.patch
+hid-i2c-hid-remove-i2c_hid_read_pending-flag-to-prevent-lock-up.patch