[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1437008972-9140-30-git-send-email-kamal@canonical.com>
Date: Wed, 15 Jul 2015 18:05:50 -0700
From: Kamal Mostafa <kamal@...onical.com>
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org,
kernel-team@...ts.ubuntu.com
Cc: Martin Sperl <kernel@...tin.sperl.org>,
Mark Brown <broonie@...nel.org>,
Kamal Mostafa <kamal@...onical.com>
Subject: [PATCH 3.19.y-ckt 029/251] spi: fix race freeing dummy_tx/rx before it is unmapped
3.19.8-ckt4 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Sperl <kernel@...tin.sperl.org>
commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.
Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).
This results in the following messages:
BUG: Bad page state in process
page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x200(arch_1)
page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
...
Reported-by: Noralf Trønnes <noralf@...nnes.org>
Suggested-by: Noralf Trønnes <noralf@...nnes.org>
Tested-by: Noralf Trønnes <noralf@...nnes.org>
Signed-off-by: Martin Sperl <kernel@...tin.sperl.org>
Signed-off-by: Mark Brown <broonie@...nel.org>
Signed-off-by: Kamal Mostafa <kamal@...onical.com>
---
drivers/spi/spi.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index a17f533..bfa47d5 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1059,9 +1059,6 @@ void spi_finalize_current_message(struct spi_master *master)
spin_lock_irqsave(&master->queue_lock, flags);
mesg = master->cur_msg;
- master->cur_msg = NULL;
-
- queue_kthread_work(&master->kworker, &master->pump_messages);
spin_unlock_irqrestore(&master->queue_lock, flags);
spi_unmap_msg(master, mesg);
@@ -1074,9 +1071,13 @@ void spi_finalize_current_message(struct spi_master *master)
}
}
- trace_spi_message_done(mesg);
-
+ spin_lock_irqsave(&master->queue_lock, flags);
+ master->cur_msg = NULL;
master->cur_msg_prepared = false;
+ queue_kthread_work(&master->kworker, &master->pump_messages);
+ spin_unlock_irqrestore(&master->queue_lock, flags);
+
+ trace_spi_message_done(mesg);
mesg->state = NULL;
if (mesg->complete)
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists