Commit 08d9db00 authored by Edgar Cherkasov's avatar Edgar Cherkasov Committed by Wolfram Sang

i2c: i2c-scmi: fix for i2c_smbus_write_block_data

The i2c-scmi driver crashes when the SMBus Write Block transaction is
executed:

WARNING: CPU: 9 PID: 2194 at mm/page_alloc.c:3931 __alloc_pages_slowpath+0x9db/0xec0
 Call Trace:
  ? get_page_from_freelist+0x49d/0x11f0
  ? alloc_pages_current+0x6a/0xe0
  ? new_slab+0x499/0x690
  __alloc_pages_nodemask+0x265/0x280
  alloc_pages_current+0x6a/0xe0
  kmalloc_order+0x18/0x40
  kmalloc_order_trace+0x24/0xb0
  ? acpi_ut_allocate_object_desc_dbg+0x62/0x10c
  __kmalloc+0x203/0x220
  acpi_os_allocate_zeroed+0x34/0x36
  acpi_ut_copy_eobject_to_iobject+0x266/0x31e
  acpi_evaluate_object+0x166/0x3b2
  acpi_smbus_cmi_access+0x144/0x530 [i2c_scmi]
  i2c_smbus_xfer+0xda/0x370
  i2cdev_ioctl_smbus+0x1bd/0x270
  i2cdev_ioctl+0xaa/0x250
  do_vfs_ioctl+0xa4/0x600
  SyS_ioctl+0x79/0x90
  do_syscall_64+0x73/0x130
  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
ACPI Error: Evaluating _SBW: 4 (20170831/smbus_cmi-185)

This problem occurs because the length of ACPI Buffer object is not
defined/initialized in the code before a corresponding ACPI method is
called. The obvious patch below fixes this issue.
Signed-off-by: default avatarEdgar Cherkasov <echerkasov@dev.rtsoft.ru>
Acked-by: default avatarViktor Krasnov <vkrasnov@dev.rtsoft.ru>
Acked-by: default avatarMichael Brunner <Michael.Brunner@kontron.com>
Signed-off-by: default avatarWolfram Sang <wsa@the-dreams.de>
parent ea51e17b
...@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags, ...@@ -152,6 +152,7 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags,
mt_params[3].type = ACPI_TYPE_INTEGER; mt_params[3].type = ACPI_TYPE_INTEGER;
mt_params[3].integer.value = len; mt_params[3].integer.value = len;
mt_params[4].type = ACPI_TYPE_BUFFER; mt_params[4].type = ACPI_TYPE_BUFFER;
mt_params[4].buffer.length = len;
mt_params[4].buffer.pointer = data->block + 1; mt_params[4].buffer.pointer = data->block + 1;
} }
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment