hdmi_conn_detect and mtk_hdmi_audio_hook_plugged_cb woule be called by different threads. plugged_cb and codec_dev are in danger of race condition.

Fixes by: - Checks NULLs first. - Uses WRITE_ONCE() to prevent store tearing (i.e. write to plugged_cb after codec_dev). - Uses codec_dev as a signal to report HDMI jack status.

The patch intends to not use mutex to protect the shared variables. In runtime, mtk_hdmi_audio_hook_plugged_cb would be called only once if no one rebinds the sound card. In contrast, hdmi_conn_detect could be called multiple times. Uses a mutex within hdmi_conn_detect calling path is a waste (no lock contention).

Fixes: 5d3c64477392 ("drm/mediatek: support HDMI jack status reporting") Signed-off-by: Tzung-Bi Shih tzungbi@google.com --- drivers/gpu/drm/mediatek/mtk_hdmi.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c index 03aeb73005ef..746567c91bb7 100644 --- a/drivers/gpu/drm/mediatek/mtk_hdmi.c +++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c @@ -1201,7 +1201,7 @@ mtk_hdmi_update_plugged_status(struct mtk_hdmi *hdmi) { bool connected = mtk_cec_hpd_high(hdmi->cec_dev);

- if (hdmi->plugged_cb && hdmi->codec_dev) + if (hdmi->codec_dev) hdmi->plugged_cb(hdmi->codec_dev, connected);

return connected ? @@ -1669,8 +1669,12 @@ static int mtk_hdmi_audio_hook_plugged_cb(struct device *dev, void *data, { struct mtk_hdmi *hdmi = data;

- hdmi->plugged_cb = fn; - hdmi->codec_dev = codec_dev; + if (!fn || !codec_dev) + return -EINVAL; + + /* Use WRITE_ONCE() to prevent store tearing. */ + WRITE_ONCE(hdmi->plugged_cb, fn); + WRITE_ONCE(hdmi->codec_dev, codec_dev); mtk_hdmi_update_plugged_status(hdmi);

return 0;