Patch "coresight: cti: Prevent negative values of enable count" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    coresight: cti: Prevent negative values of enable count

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     coresight-cti-prevent-negative-values-of-enable-coun.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f681c0e99cda8c4d36d460d9876ff8c87dac29ec
Author: James Clark <james.clark@xxxxxxx>
Date:   Tue Jan 10 11:07:34 2023 +0000

    coresight: cti: Prevent negative values of enable count
    
    [ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ]
    
    Writing 0 to the enable control repeatedly results in a negative value
    for enable_req_count. After this, writing 1 to the enable control
    appears to not work until the count returns to positive.
    
    Change it so that it's impossible for enable_req_count to be < 0.
    Return an error to indicate that the disable request was invalid.
    
    Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver")
    Tested-by: Jinlong Mao <quic_jinlmao@xxxxxxxxxxx>
    Signed-off-by: James Clark <james.clark@xxxxxxx>
    Reviewed-by: Mike Leach <mike.leach@xxxxxxxxxx>
    Signed-off-by: Suzuki K Poulose <suzuki.poulose@xxxxxxx>
    Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@xxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
index d2cf4f4848e1b..838872f2484d3 100644
--- a/drivers/hwtracing/coresight/coresight-cti-core.c
+++ b/drivers/hwtracing/coresight/coresight-cti-core.c
@@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
 {
 	struct cti_config *config = &drvdata->config;
 	struct coresight_device *csdev = drvdata->csdev;
+	int ret = 0;
 
 	spin_lock(&drvdata->spinlock);
 
+	/* don't allow negative refcounts, return an error */
+	if (!atomic_read(&drvdata->config.enable_req_count)) {
+		ret = -EINVAL;
+		goto cti_not_disabled;
+	}
+
 	/* check refcount - disable on 0 */
 	if (atomic_dec_return(&drvdata->config.enable_req_count) > 0)
 		goto cti_not_disabled;
@@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
 	coresight_disclaim_device_unlocked(csdev);
 	CS_LOCK(drvdata->base);
 	spin_unlock(&drvdata->spinlock);
-	return 0;
+	return ret;
 
 	/* not disabled this call */
 cti_not_disabled:
 	spin_unlock(&drvdata->spinlock);
-	return 0;
+	return ret;
 }
 
 void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value)