Commit f98b9a26 authored Dec 21, 2011 by Javi Merino Committed by Russell King Jan 03, 2012

ARM: 7242/1: PL330: Detach the request from the pl330_thread when it finishes successful

When a request has finished successfully and we are about to call its
callback, remove its pointer from the corresponding pl330_thread .
This prevents the core driver from calling its callback again if
pl330_release_channel() is called without first flushing the device.
When pl330_update() returns, the driver is allowed to free the pointer
to pl330_req so the core driver shouldn't be able to access it again.

Reference: <CAJe_ZhftO+481BfL0ErEcM_brfmSuTXkTEniLRYxxM2T7OM2QA@mail.gmail.com>

Signed-off-by: Javi Merino <javi.merino@arm.com>
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

parent 1ec332a3

arch/arm/common/pl330.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -1467,13 +1467,19 @@ int pl330_update(const struct pl330_info *pi)

		/* Now that we are in no hurry, do the callbacks */
		while (!list_empty(&pl330->req_done)) {
		struct pl330_req *r;

		rqdone = container_of(pl330->req_done.next,
		struct _pl330_req, rqd);

		list_del_init(&rqdone->rqd);

		/* Detach the req */
		r = rqdone->r;
		rqdone->r = NULL;

		spin_unlock_irqrestore(&pl330->lock, flags);
		_callback(rqdone->r, PL330_ERR_NONE);
		_callback(r, PL330_ERR_NONE);
		spin_lock_irqsave(&pl330->lock, flags);
		}