summaryrefslogtreecommitdiffstats
path: root/drivers/spi
diff options
context:
space:
mode:
authorAndrew Gabbasov <andrew_gabbasov@mentor.com>2015-06-30 10:48:37 -0500
committerMark Brown <broonie@kernel.org>2015-07-07 13:09:46 +0100
commit65598c13fd66c3b5eac16d5b8eacc704aa17ce40 (patch)
treeefe1bffa55ae29af9ec71def84e35727e93b2bd9 /drivers/spi
parentd770e558e21961ad6cfdf0ff7df0eb5d7d4f0754 (diff)
downloadlinux-stable-65598c13fd66c3b5eac16d5b8eacc704aa17ce40.tar.gz
linux-stable-65598c13fd66c3b5eac16d5b8eacc704aa17ce40.tar.bz2
linux-stable-65598c13fd66c3b5eac16d5b8eacc704aa17ce40.zip
spi: Fix per-page mapping of unaligned vmalloc-ed buffer
spi_map_buf() processes mapping of vmalloc-ed buffers in a special way, making mapping of every page separately. However, if the buffer is not aligned to page boundary (e.g. sub-array in a vmalloc-ed array), it fills the scatter table with page-size unaligned pieces, that cross page boundaries. This is incorrect and can, for example, cause memory corruption and various crashes when working with ubifs on spi-nor chips (though those drivers are themselves buggy in that they should be providing DMAable memory to the SPI framework). Fix this by using proper scatter table size and intra-page buffer lengths, so that the whole buffer splits into separate scatter table entries on page boundaries. Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spi.c16
1 files changed, 13 insertions, 3 deletions
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index cf8b91b23a76..27e4f1f116ee 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -476,21 +476,30 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
enum dma_data_direction dir)
{
const bool vmalloced_buf = is_vmalloc_addr(buf);
- const int desc_len = vmalloced_buf ? PAGE_SIZE : master->max_dma_len;
- const int sgs = DIV_ROUND_UP(len, desc_len);
+ int desc_len;
+ int sgs;
struct page *vm_page;
void *sg_buf;
size_t min;
int i, ret;
+ if (vmalloced_buf) {
+ desc_len = PAGE_SIZE;
+ sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len);
+ } else {
+ desc_len = master->max_dma_len;
+ sgs = DIV_ROUND_UP(len, desc_len);
+ }
+
ret = sg_alloc_table(sgt, sgs, GFP_KERNEL);
if (ret != 0)
return ret;
for (i = 0; i < sgs; i++) {
- min = min_t(size_t, len, desc_len);
if (vmalloced_buf) {
+ min = min_t(size_t,
+ len, desc_len - offset_in_page(buf));
vm_page = vmalloc_to_page(buf);
if (!vm_page) {
sg_free_table(sgt);
@@ -499,6 +508,7 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
sg_set_page(&sgt->sgl[i], vm_page,
min, offset_in_page(buf));
} else {
+ min = min_t(size_t, len, desc_len);
sg_buf = buf;
sg_set_buf(&sgt->sgl[i], sg_buf, min);
}