Re: [PATCH 18/28] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe

[Qunqin Zhao]

在 2026/10/21 20:09, Lee Jones 写道:
> loongson_se_probe() allocates struct loongson_se using devm_kmalloc(),
> leaving the se->engines array uninitialised until child MFD drivers
> later invoke loongson_se_init_engine().  Meanwhile, hardware interrupts
> are unmasked and se_irq_handler() is registered during probe.  Any
> engine interrupt arriving before loongson_se_init_engine() runs causes
> se_irq_handler() to call complete() on an uninitialised completion
> structure.
>
> Allocate struct loongson_se with devm_kzalloc() and initialise all
> engine completion structures in loongson_se_probe() before registering
> interrupt handlers.
>
> Fixes: e551fa3159e3 ("mfd: Add support for Loongson Security Engine chip controller")
> Closes: https://sashiko.dev/#/bug/linux-ad9310d7-13b2-4a4a-ad7d-78a4c612c78c
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>

Reviewed-by: Qunqin Zhao <zhaoqunqin@xxxxxxxxxxx>

Thanks for fixing this!


Best Regards,

Qunqin.

> ---
>  drivers/mfd/loongson-se.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mfd/loongson-se.c b/drivers/mfd/loongson-se.c
> index 9b531e62fb85..187ebbed0422 100644
> --- a/drivers/mfd/loongson-se.c
> +++ b/drivers/mfd/loongson-se.c
> @@ -106,7 +106,6 @@ struct loongson_se_engine *loongson_se_init_engine(struct device *dev, int id)
>  
>  	engine->se = se;
>  	engine->id = id;
> -	init_completion(&engine->completion);
>  
>  	/* Divide DMA memory equally among all engines */
>  	engine->buffer_size = se->dmam_size / SE_ENGINE_MAX;
> @@ -199,12 +198,14 @@ static int loongson_se_probe(struct platform_device *pdev)
>  	int nr_irq, irq, err, i;
>  	dma_addr_t paddr;
>  
> -	se = devm_kmalloc(dev, sizeof(*se), GFP_KERNEL);
> +	se = devm_kzalloc(dev, sizeof(*se), GFP_KERNEL);
>  	if (!se)
>  		return -ENOMEM;
>  
>  	dev_set_drvdata(dev, se);
>  	init_completion(&se->cmd_completion);
> +	for (i = 0; i < SE_ENGINE_MAX; i++)
> +		init_completion(&se->engines[i].completion);
>  	spin_lock_init(&se->dev_lock);
>  	mutex_init(&se->engine_init_lock);
>