diff options
| author | Martin Sperl <kernel@martin.sperl.org> | 2015-05-10 07:50:45 +0000 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2015-07-09 14:35:59 +0100 |
| commit | a1800bf1690821717e58399f8ae698bf0e6a7ae9 (patch) | |
| tree | f3d8d91e412f6d98faf3f2c8284ba72c9f597e3f /drivers/spi | |
| parent | 14b5741806e78d7acdcdf165511137d598b892c4 (diff) | |
| download | linux-stable-a1800bf1690821717e58399f8ae698bf0e6a7ae9.tar.gz linux-stable-a1800bf1690821717e58399f8ae698bf0e6a7ae9.tar.bz2 linux-stable-a1800bf1690821717e58399f8ae698bf0e6a7ae9.zip | |
spi: fix race freeing dummy_tx/rx before it is unmapped
commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.
Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).
This results in the following messages:
BUG: Bad page state in process
page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x200(arch_1)
page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
...
Reported-by: Noralf Trønnes <noralf@tronnes.org>
Suggested-by: Noralf Trønnes <noralf@tronnes.org>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 577605167be2..3950e4495093 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -1039,9 +1039,6 @@ void spi_finalize_current_message(struct spi_master *master) spin_lock_irqsave(&master->queue_lock, flags); mesg = master->cur_msg; - master->cur_msg = NULL; - - queue_kthread_work(&master->kworker, &master->pump_messages); spin_unlock_irqrestore(&master->queue_lock, flags); spi_unmap_msg(master, mesg); @@ -1054,9 +1051,13 @@ void spi_finalize_current_message(struct spi_master *master) } } - trace_spi_message_done(mesg); - + spin_lock_irqsave(&master->queue_lock, flags); + master->cur_msg = NULL; master->cur_msg_prepared = false; + queue_kthread_work(&master->kworker, &master->pump_messages); + spin_unlock_irqrestore(&master->queue_lock, flags); + + trace_spi_message_done(mesg); mesg->state = NULL; if (mesg->complete) |