• Mika Westerberg's avatar
    spi/pxa2xx: Clear cur_chip pointer before starting next message · c957e8f0
    Mika Westerberg authored
    Once the current message is finished, the driver notifies SPI core about
    this by calling spi_finalize_current_message(). This function queues next
    message to be transferred. If there are more messages in the queue, it is
    possible that the driver is asked to transfer the next message at this
    point.
    
    When spi_finalize_current_message() returns the driver clears the
    drv_data->cur_chip pointer to NULL. The problem is that if the driver
    already started the next message clearing drv_data->cur_chip will cause
    NULL pointer dereference which crashes the kernel like:
    
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
     IP: [<ffffffffa0022bc8>] cs_deassert+0x18/0x70 [spi_pxa2xx_platform]
     PGD 78bb8067 PUD 37712067 PMD 0
     Oops: 0000 [#1] SMP
     Modules linked in:
     CPU: 1 PID: 11 Comm: ksoftirqd/1 Tainted: G           O   3.18.0-rc4-mjo #5
     Hardware name: Intel Corp. VALLEYVIEW B3 PLATFORM/NOTEBOOK, BIOS MNW2CRB1.X64.0071.R30.1408131301 08/13/2014
     task: ffff880077f9f290 ti: ffff88007a820000 task.ti: ffff88007a820000
     RIP: 0010:[<ffffffffa0022bc8>]  [<ffffffffa0022bc8>] cs_deassert+0x18/0x70 [spi_pxa2xx_platform]
     RSP: 0018:ffff88007a823d08  EFLAGS: 00010202
     RAX: 0000000000000008 RBX: ffff8800379a4430 RCX: 0000000000000026
     RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff8800379a4430
     RBP: ffff88007a823d18 R08: 00000000ffffffff R09: 000000007a9bc65a
     R10: 000000000000028f R11: 0000000000000005 R12: ffff880070123e98
     R13: ffff880070123de8 R14: 0000000000000100 R15: ffffc90004888000
     FS:  0000000000000000(0000) GS:ffff880079a80000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
     CR2: 0000000000000048 CR3: 000000007029b000 CR4: 00000000001007e0
     Stack:
      ffff88007a823d58 ffff8800379a4430 ffff88007a823d48 ffffffffa0022c89
      0000000000000000 ffff8800379a4430 0000000000000000 0000000000000006
      ffff88007a823da8 ffffffffa0023be0 ffff88007a823dd8 ffffffff81076204
     Call Trace:
      [<ffffffffa0022c89>] giveback+0x69/0xa0 [spi_pxa2xx_platform]
      [<ffffffffa0023be0>] pump_transfers+0x710/0x740 [spi_pxa2xx_platform]
      [<ffffffff81076204>] ? pick_next_task_fair+0x744/0x830
      [<ffffffff81049679>] tasklet_action+0xa9/0xe0
      [<ffffffff81049a0e>] __do_softirq+0xee/0x280
      [<ffffffff81049bc0>] run_ksoftirqd+0x20/0x40
      [<ffffffff810646df>] smpboot_thread_fn+0xff/0x1b0
      [<ffffffff810645e0>] ? SyS_setgroups+0x150/0x150
      [<ffffffff81060f9d>] kthread+0xcd/0xf0
      [<ffffffff81060ed0>] ? kthread_create_on_node+0x180/0x180
      [<ffffffff8187a82c>] ret_from_fork+0x7c/0xb0
    
    Fix this by clearing drv_data->cur_chip before we call spi_finalize_current_message().
    Reported-by: default avatarMartin Oldfield <m@mjoldfield.com>
    Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
    Acked-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
    Signed-off-by: default avatarMark Brown <broonie@kernel.org>
    Cc: stable@vger.kernel.org
    c957e8f0
spi-pxa2xx.c 39.8 KB