This is a note to let you know that I've just added the patch titled
spi: fix race freeing dummy_tx/rx before it is unmapped
to the 4.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch
and it can be found in the queue-4.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 8e76ef88f607174082023f50b87fe12dcdbe5db5 Mon Sep 17 00:00:00 2001
From: Martin Sperl <kernel@xxxxxxxxxxxxxxxx>
Date: Sun, 10 May 2015 07:50:45 +0000
Subject: spi: fix race freeing dummy_tx/rx before it is unmapped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Martin Sperl <kernel@xxxxxxxxxxxxxxxx>
commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.
Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).
This results in the following messages:
BUG: Bad page state in process
page:db7ba030 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x200(arch_1)
page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
...
Reported-by: Noralf Trønnes <noralf@xxxxxxxxxxx>
Suggested-by: Noralf Trønnes <noralf@xxxxxxxxxxx>
Tested-by: Noralf Trønnes <noralf@xxxxxxxxxxx>
Signed-off-by: Martin Sperl <kernel@xxxxxxxxxxxxxxxx>
Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/spi/spi.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1091,9 +1091,6 @@ void spi_finalize_current_message(struct
spin_lock_irqsave(&master->queue_lock, flags);
mesg = master->cur_msg;
- master->cur_msg = NULL;
-
- queue_kthread_work(&master->kworker, &master->pump_messages);
spin_unlock_irqrestore(&master->queue_lock, flags);
spi_unmap_msg(master, mesg);
@@ -1106,9 +1103,13 @@ void spi_finalize_current_message(struct
}
}
- trace_spi_message_done(mesg);
-
+ spin_lock_irqsave(&master->queue_lock, flags);
+ master->cur_msg = NULL;
master->cur_msg_prepared = false;
+ queue_kthread_work(&master->kworker, &master->pump_messages);
+ spin_unlock_irqrestore(&master->queue_lock, flags);
+
+ trace_spi_message_done(mesg);
mesg->state = NULL;
if (mesg->complete)
Patches currently in stable-queue which might be from kernel@xxxxxxxxxxxxxxxx are
queue-4.0/spi-fix-race-freeing-dummy_tx-rx-before-it-is-unmapped.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html