When shutdown, rk808 driver shutdown first, so io_lock mutex is locked.
At same time, gpu change freq by runtime pm, will locked on rk808_reg_read.
Finally, gpu device shutdown, call pm_runtime_barrier. Deadlock happens.
Fix this bug by make rk808 shutdown later.
task PC stack pid father
init D c06e9a14 0 1 0 0x00000000
[<c06e9a14>] (__schedule+0x48c/0x554) from [<c02e281c>] (__pm_runtime_barrier+0x114/0x138)
[<c02e281c>] (__pm_runtime_barrier+0x114/0x138) from [<c02e3cf4>] (pm_runtime_barrier+0x68/0xb8)
[<c02e3cf4>] (pm_runtime_barrier+0x68/0xb8) from [<c02d85ac>] (device_shutdown+0xa0/0x190)
[<c02d85ac>] (device_shutdown+0xa0/0x190) from [<c0042128>] (kernel_restart+0xc/0x50)
[<c0042128>] (kernel_restart+0xc/0x50) from [<c00422c4>] (SyS_reboot+0x150/0x1b0)
[<c00422c4>] (SyS_reboot+0x150/0x1b0) from [<c000da00>] (ret_fast_syscall+0x0/0x30)
kworker/2:1 D c06e9a14 0 32 2 0x00000000
Workqueue: pm pm_runtime_work
[<c06e9a14>] (__schedule+0x48c/0x554) from [<c06e9ec0>] (schedule_preempt_disabled+0x24/0x34)
[<c06e9ec0>] (schedule_preempt_disabled+0x24/0x34) from [<c06e8bf8>] (__mutex_lock_slowpath+0x1c0/0x22c)
[<c06e8bf8>] (__mutex_lock_slowpath+0x1c0/0x22c) from [<c06e8c94>] (mutex_lock+0x30/0x48)
[<c06e8c94>] (mutex_lock+0x30/0x48) from [<c02f0dbc>] (rk808_reg_read+0x24/0x5c)
[<c02f0dbc>] (rk808_reg_read+0x24/0x5c) from [<c02f0fa8>] (rk808_dcdc_is_enabled+0x28/0x38)
[<c02f0fa8>] (rk808_dcdc_is_enabled+0x28/0x38) from [<c02a6acc>] (_regulator_is_enabled+0x34/0x40)
[<c02a6acc>] (_regulator_is_enabled+0x34/0x40) from [<c02a6c50>] (_regulator_do_set_voltage+0xbc/0x3e4)
[<c02a6c50>] (_regulator_do_set_voltage+0xbc/0x3e4) from [<c02a7c1c>] (regulator_set_voltage+0xc0/0xe0)
[<c02a7c1c>] (regulator_set_voltage+0xc0/0xe0) from [<c0027b7c>] (dvfs_regulator_set_voltage_readback.isra.6+0x14/0x8c)
[<c0027b7c>] (dvfs_regulator_set_voltage_readback.isra.6+0x14/0x8c) from [<c0027d5c>] (dvfs_scale_volt_direct+0xa0/0xc4)
[<c0027d5c>] (dvfs_scale_volt_direct+0xa0/0xc4) from [<c0027f24>] (dvfs_target+0x1a4/0x1d4)
[<c0027f24>] (dvfs_target+0x1a4/0x1d4) from [<c00273e8>] (dvfs_clk_set_rate+0x44/0x80)
[<c00273e8>] (dvfs_clk_set_rate+0x44/0x80) from [<c02c1388>] (mali_dvfs_clk_set+0x28/0x48)
[<c02c1388>] (mali_dvfs_clk_set+0x28/0x48) from [<c02c01f4>] (kbase_platform_dvfs_set_level+0x9c/0xe0)
[<c02c01f4>] (kbase_platform_dvfs_set_level+0x9c/0xe0) from [<c02c032c>] (kbase_platform_dvfs_enable+0xf4/0x110)
[<c02c032c>] (kbase_platform_dvfs_enable+0xf4/0x110) from [<c02bf908>] (pm_callback_runtime_off+0x3c/0x58)
[<c02bf908>] (pm_callback_runtime_off+0x3c/0x58) from [<c02d2650>] (kbase_device_runtime_suspend+0x24/0x34)
[<c02d2650>] (kbase_device_runtime_suspend+0x24/0x34) from [<c02de738>] (pm_generic_runtime_suspend+0x2c/0x40)
[<c02de738>] (pm_generic_runtime_suspend+0x2c/0x40) from [<c02e25c4>] (__rpm_callback+0x38/0x68)
[<c02e25c4>] (__rpm_callback+0x38/0x68) from [<c02e2658>] (rpm_callback+0x64/0x7c)
[<c02e2658>] (rpm_callback+0x64/0x7c) from [<c02e3210>] (rpm_suspend+0x2d8/0x534)
[<c02e3210>] (rpm_suspend+0x2d8/0x534) from [<c02e3e60>] (pm_runtime_work+0x7c/0x94)
[<c02e3e60>] (pm_runtime_work+0x7c/0x94) from [<c004773c>] (process_one_work+0x29c/0x458)
[<c004773c>] (process_one_work+0x29c/0x458) from [<c0047a8c>] (worker_thread+0x194/0x2d4)
[<c0047a8c>] (worker_thread+0x194/0x2d4) from [<c004cf74>] (kthread+0xa0/0xac)
[<c004cf74>] (kthread+0xa0/0xac) from [<c000da98>] (ret_from_fork+0x14/0x3c)
commit 483e2dfdbc upstream.
Fixes: 4aab3fadad ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:
1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
(because regmap_add_irq_chip() will free it on error)
This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 97dc4ed3fa upstream.
During probe the driver allocates dummy I2C devices for RTC, haptic and
MUIC with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
probe for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ed26f87b9f upstream.
During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 96cf3dedc4 upstream.
During probe the driver allocates dummy I2C devices for RTC and ADC
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit ad09dd6a1f upstream.
During probe the driver allocates dummy I2C devices for MUIC and haptic
with i2c_new_dummy() but it does not check the return value of this
calls.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by devm_regmap_init_i2c() and i2c_unregister_device().
If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
for main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b9e183a1d4 upstream.
During probe the driver allocates dummy I2C device for RTC with
i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a7ab1c8b26 upstream.
During probe the driver allocates dummy I2C device for companion chip
and then allocates a regmap for it. If regmap_init_i2c() fails then the
I2C driver (allocated with i2c_new_dummy()) is not freed and this
resource leaks.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 159ce52a6b upstream.
During probe the driver allocates dummy I2C device for companion chip
with i2c_new_dummy() but it does not check the return value of this call.
In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by regmap_init_i2c().
If i2c_new_dummy() fails for companion device, fail also the probe for
main MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 65aba1e049 upstream.
During probe the sec-core driver allocates dummy I2C device for RTC with
i2c_new_dummy() but return value is not checked. In case of error
(i2c_new_device(): memory allocation failure or I2C address cannot be
used) this function returns NULL which is later used by
devm_regmap_init_i2c() or i2c_unregister_device().
If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
