lkml.org 
[lkml]   [2014]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 3.12 037/107] spidev: fix hang when transfer_one_message fails
From
On Tue, Feb 11, 2014 at 8:05 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> 3.12-stable review patch. If anyone has any objections, please let me know.

Sorry for not noticing this was queued up for stable before, but this
patch was reverted in mainline:

commit 1f802f8249a0da536877842c43c7204064c4de8b
Author: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Date: Tue Jan 28 10:33:03 2014 +0100

spi: Fix crash with double message finalisation on error handling

This reverts commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d.

It causes a NULL pointer dereference with drivers using the generic
spi_transfer_one_message(), which always calls
spi_finalize_current_message(), which zeroes master->cur_msg.

Drivers implementing transfer_one_message() theirselves must always call
spi_finalize_current_message(), even if the transfer failed:

* @transfer_one_message: the subsystem calls the driver to transfer a singl
* message while queuing transfers that arrive in the meantime. When th
* driver is finished with this message, it must call
* spi_finalize_current_message() so the subsystem can issue the next
* transfer

Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>

> ------------------
>
> From: Daniel Santos <daniel.santos@pobox.com>
>
> commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d upstream.
>
> This corrects a problem in spi_pump_messages() that leads to an spi
> message hanging forever when a call to transfer_one_message() fails.
> This failure occurs in my MCP2210 driver when the cs_change bit is set
> on the last transfer in a message, an operation which the hardware does
> not support.
>
> Rationale
> Since the transfer_one_message() returns an int, we must presume that it
> may fail. If transfer_one_message() should never fail, it should return
> void. Thus, calls to transfer_one_message() should properly manage a
> failure.
>
> Fixes: ffbbdd21329f3 (spi: create a message queueing infrastructure)
> Signed-off-by: Daniel Santos <daniel.santos@pobox.com>
> Signed-off-by: Mark Brown <broonie@linaro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/spi/spi.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> --- a/drivers/spi/spi.c
> +++ b/drivers/spi/spi.c
> @@ -600,7 +600,9 @@ static void spi_pump_messages(struct kth
> ret = master->transfer_one_message(master, master->cur_msg);
> if (ret) {
> dev_err(&master->dev,
> - "failed to transfer one message from queue\n");
> + "failed to transfer one message from queue: %d\n", ret);
> + master->cur_msg->status = ret;
> + spi_finalize_current_message(master);
> return;
> }
> }

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds


\
 
 \ /
  Last update: 2014-02-20 14:21    [W:0.496 / U:0.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site