Calling ->sync_write must be done while holding the PPM lock as the mailbox logic does not support concurrent commands. Thus protect the only call to ucsi_acknowledge_connector_change with the PPM lock as it calls ->sync_write. All other calls to ->sync_write already happen under the PPM lock. Signed-off-by: Christian A. Ehrhardt <lk@xxxxxxx> --- NOTE: This is not a theoretical issue. I've seen problems resulting from the missing lock on real hardware. drivers/usb/typec/ucsi/ucsi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 61b64558f96c..8f9dff993b3d 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -935,7 +935,9 @@ static void ucsi_handle_connector_change(struct work_struct *work) clear_bit(EVENT_PENDING, &con->ucsi->flags); + mutex_lock(&ucsi->ppm_lock); ret = ucsi_acknowledge_connector_change(ucsi); + mutex_unlock(&ucsi->ppm_lock); if (ret) dev_err(ucsi->dev, "%s: ACK failed (%d)", __func__, ret); -- 2.40.1
