From nobody Sat Jul 4 20:00:04 2026 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B671D21773D for ; Sat, 4 Jul 2026 15:43:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783179793; cv=none; b=caVOaQ3s5Fs/UTsk5thg6TorLEJilxS4n54ZPcUdWfd0oRwEjlE+RbWHRHA9Nx86ejAHlqWQSiKWRbTerUn1Gf1LgjiMiwF/JzPg0Cuu0UftCBrJKUMxqudA9AR8AUD5WwKSIJDkMmN7PsYWAMYWkmn6t9ye4IAFV6SOfdWsY4s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783179793; c=relaxed/simple; bh=5+434mrhNFCVreVO5PMVEkojrR3Q+VTps1ur2DUp2+I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=tUigH9RJJNn7tjo3dJYFrNwE4b5tmcPbe4zrRNFCwWUNTgrOTBK9Jbb0qUNuGX9PQHBoCAsoC2p0BYFJtHAFZAsyyb/6gau3IHW0s1bw2UFCcST+8dvlORESEM0w92yubOcDgSQeIENE+Z60EHXyphgNOFniHuQwEtkuSsNoKuY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SEkDeVf0; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SEkDeVf0" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-847aebc56b6so1158524b3a.3 for ; Sat, 04 Jul 2026 08:43:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783179790; x=1783784590; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=q/NZqjgS2aeNz/4jTSFjlw+7y1oyriEp+WR7nSStBWU=; b=SEkDeVf0oCCGO/N67xzHGdv7My8/16grKLrw5DjnZsdJve1EUwFEFCtQjkKPnygPLC gh/b25GuyIu4Ffb0NjTzTLE8oyKMZcLSDZ+JarBMqEBFCw+ucwxhr44nq53AGioBxXM4 09Nayu+LJWrQj91fMtykIYZhgolypYHLwJw02D8m7HHd9g4qhw/KCEOTXPQLfTyi+fTy 7A5PCuLLV8ywfQMDSnyepPjS0x3ZlLfxlscz0Dp4p2/2ANyB1Tc/WdLjMOYsxsuUVuXw 0RHZfZ2b8VbJWIJC0c6Hf8ULLIeb38gHHyhNUCx6+d2ryH67d4BmiXnjLpu3hffFGBKa PMtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783179790; x=1783784590; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=q/NZqjgS2aeNz/4jTSFjlw+7y1oyriEp+WR7nSStBWU=; b=O9pxIQbjKQ90ZK0s9P+Ua97jSELYW6Qv7wchTxmDnguZ8Qa9X3zx8rMTV6SzISWIGc F0AYEH7aTK/WtCSKFMO54F88lZBTps0zBbToP7J7NcEdtI6BepSO9DX/WkiH4AIQZCwQ BgsVWXQ+7O+H9E+1mCZ4xaG11LTiktOgu0iQoT7DBKbKmO3iXtLLsFPuNXDwbrDoD50G DcFOV3LbKDioBcnSX0Nr17FxM0Ny7M4Q2e0XdAa9ob1+tnMQJQa/gQENY029OKEiDmDP mLiD3yjV73TUEYMX4xLGeDNDBiiYosBwD04X2L/JttjYqUw0LUVFfgDKK87YFkWO7Ojy i+zQ== X-Forwarded-Encrypted: i=1; AHgh+RriKpHYT9VLOJRDCMtehMfUkHm5Gry5vfoFv751J1Syws3ucKECfPOFIZF2MJneL2imHzL/vfhcDZhxTKY=@vger.kernel.org X-Gm-Message-State: AOJu0Yy6y6ahr6Aqxrlo9tCgBjuwmMIIU9aMur3XBPtIFc4fC0n/ZaYV 9AOoLICEwrd4UTTIUo5iwlp3LsksyOOaKCYmPBb1+y5IJOTC2LlT05M0 X-Gm-Gg: AfdE7clmjmdIC8ua+xDzf8o6rJl/4wWAb+a882uAXK0IIWIJEGVTRv9fPNVcVZYRDT6 ri5T5H9QFHBi13SG36os6PXXZXew0Tg6rUhLnB6PLDgx2Q6tf7St6dIn0jlXVfBKPrKRyNk4AHz upBbE0i2xM8sHoJPre8JDbf8eCEQA+2hz0Dma434ObFTy6pnknF0ZKJKtqPGcUQxYjm40sUfYg9 qP1OW1BdGkqLIy0sjaTNYV1yGnG0iFoUBt/qjus49UdHDOLjTX7Xtc0vOKj/5rzYfcH8lglAqWj S4Axc4Y43hhiCBPgxWbXw9fykMGfZLj6bPxjO4uluoWfNaODtmCR4UgZKHlhxIqGRmtYNzC4RtN U74fpUICCKRoYdPbxDYORRVk3NTPzEyhZzF0PPNwfV0VHNADHE8oiJdQirzxiwKlBDWFOMdop1z QY0c2/QJvGkyiWHLqf7wYd X-Received: by 2002:a05:6a00:2308:b0:845:396f:5be7 with SMTP id d2e1a72fcca58-847f6d5e221mr3509996b3a.5.1783179790003; Sat, 04 Jul 2026 08:43:10 -0700 (PDT) Received: from lgs.. ([101.76.249.46]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c9e8eb0efc8sm4148463a12.5.2026.07.04.08.43.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 08:43:09 -0700 (PDT) From: Guangshuo Li To: Bjorn Andersson , Konrad Dybcio , Sumit Garg , Manivannan Sadhasivam , linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] soc: qcom: ice: Fix storing raw error pointers in XArray Date: Sat, 4 Jul 2026 23:43:00 +0800 Message-ID: <20260704154300.98504-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" qcom_ice_probe() stores probe failures in ice_handles so that of_qcom_ice_get() can distinguish between an ICE device that has not probed yet and one that has failed permanently. However, the failure paths store raw ERR_PTR() values in the XArray. XArray entries use low pointer bits for internal encodings, so some ERR_PTR() values can be interpreted as internal entries. For example, ERR_PTR(-EINVAL) has the internal-node bit pattern and may be treated as an xa_node by xa_load(), causing xas_load() to dereference an invalid pointer before of_qcom_ice_get() reaches IS_ERR_OR_NULL(). Store probe failures as xa_mk_value() encoded errno values instead, and convert them back to ERR_PTR() values when loading them from the XArray. Fixes: d922113ef91e ("soc: qcom: ice: Fix race between qcom_ice_probe() and= of_qcom_ice_get()") Signed-off-by: Guangshuo Li --- drivers/soc/qcom/ice.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/soc/qcom/ice.c b/drivers/soc/qcom/ice.c index 5f20108aa03e..bc77dce971a6 100644 --- a/drivers/soc/qcom/ice.c +++ b/drivers/soc/qcom/ice.c @@ -667,12 +667,12 @@ static struct qcom_ice *of_qcom_ice_get(struct device= *dev) } =20 ice =3D xa_load(&ice_handles, pdev->dev.of_node->phandle); - if (IS_ERR_OR_NULL(ice)) { + if (!ice || xa_is_value(ice)) { platform_device_put(pdev); if (!ice) return ERR_PTR(-EPROBE_DEFER); else - return ice; + return ERR_PTR(-(long)xa_to_value(ice)); } =20 link =3D device_link_add(dev, &pdev->dev, DL_FLAG_AUTOREMOVE_SUPPLIER); @@ -744,15 +744,17 @@ static int qcom_ice_probe(struct platform_device *pde= v) base =3D devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(base)) { dev_warn(&pdev->dev, "ICE registers not found\n"); - /* Store the error pointer for devm_of_qcom_ice_get() */ - xa_store(&ice_handles, phandle, (__force void *)base, GFP_KERNEL); + /* Store the error code for devm_of_qcom_ice_get() */ + xa_store(&ice_handles, phandle, + xa_mk_value(-PTR_ERR(base)), GFP_KERNEL); return PTR_ERR(base); } =20 engine =3D qcom_ice_create(&pdev->dev, base); if (IS_ERR(engine)) { - /* Store the error pointer for devm_of_qcom_ice_get() */ - xa_store(&ice_handles, phandle, engine, GFP_KERNEL); + /* Store the error code for devm_of_qcom_ice_get() */ + xa_store(&ice_handles, phandle, + xa_mk_value(-PTR_ERR(engine)), GFP_KERNEL); return PTR_ERR(engine); } =20 --=20 2.43.0