This is a note to let you know that I've just added the patch titled spi: fix race freeing dummy_tx/rx before it is unmapped to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 8e76ef88f607174082023f50b87fe12dcdbe5db5 Mon Sep 17 00:00:00 2001 From: Martin Sperl <kernel@xxxxxxxxxxxxxxxx> Date: Sun, 10 May 2015 07:50:45 +0000 Subject: spi: fix race freeing dummy_tx/rx before it is unmapped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Martin Sperl <kernel@xxxxxxxxxxxxxxxx> commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream. Fix a race (with some kernel configurations) where a queued master->pump_messages runs and frees dummy_tx/rx before spi_unmap_msg is running (or is finished). This results in the following messages: BUG: Bad page state in process page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200(arch_1) page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set ... Reported-by: Noralf Trønnes <noralf@xxxxxxxxxxx> Suggested-by: Noralf Trønnes <noralf@xxxxxxxxxxx> Tested-by: Noralf Trønnes <noralf@xxxxxxxxxxx> Signed-off-by: Martin Sperl <kernel@xxxxxxxxxxxxxxxx> Signed-off-by: Mark Brown <broonie@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/spi/spi.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spin_lock_irqsave(&master->queue_lock, flags); mesg = master->cur_msg; - master->cur_msg = NULL; - - queue_kthread_work(&master->kworker, &master->pump_messages); spin_unlock_irqrestore(&master->queue_lock, flags); if (master->cur_msg_prepared && master->unprepare_message) { @@ -847,9 +844,13 @@ void spi_finalize_current_message(struct } } - trace_spi_message_done(mesg); - + spin_lock_irqsave(&master->queue_lock, flags); + master->cur_msg = NULL; master->cur_msg_prepared = false; + queue_kthread_work(&master->kworker, &master->pump_messages); + spin_unlock_irqrestore(&master->queue_lock, flags); + + trace_spi_message_done(mesg); mesg->state = NULL; if (mesg->complete) Patches currently in stable-queue which might be from kernel@xxxxxxxxxxxxxxxx are queue-3.14/spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html