Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3dfa0e0 authored by Martin Sperl's avatar Martin Sperl Committed by Sasha Levin
Browse files

spi: fix race freeing dummy_tx/rx before it is unmapped 



[ Upstream commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 ]

Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).

This results in the following messages:
  BUG: Bad page state in process
  page:db7ba030 count:0 mapcount:0 mapping:  (null) index:0x0
  flags: 0x200(arch_1)
  page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
  ...

Reported-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Suggested-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Tested-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Signed-off-by: default avatarMartin Sperl <kernel@martin.sperl.org>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent 22f36a48

drivers/spi/spi.c

+6 −5
Original line number Diff line number Diff line
@@ -1059,9 +1059,6 @@ void spi_finalize_current_message(struct spi_master *master) 


	spin_lock_irqsave(&master->queue_lock, flags);

	mesg = master->cur_msg;

	master->cur_msg = NULL;



	queue_kthread_work(&master->kworker, &master->pump_messages);

	spin_unlock_irqrestore(&master->queue_lock, flags);



	spi_unmap_msg(master, mesg);
@@ -1074,9 +1071,13 @@ void spi_finalize_current_message(struct spi_master *master) 
		}

	}



	trace_spi_message_done(mesg);



	spin_lock_irqsave(&master->queue_lock, flags);

	master->cur_msg = NULL;

	master->cur_msg_prepared = false;

	queue_kthread_work(&master->kworker, &master->pump_messages);

	spin_unlock_irqrestore(&master->queue_lock, flags);



	trace_spi_message_done(mesg);



	mesg->state = NULL;

	if (mesg->complete)