lkml.org 
[lkml]   [2015]   [Jun]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] spi: Fix per-page mapping of unaligned vmalloc-ed buffer
Date
spi_map_buf() processes mapping of vmalloc-ed buffers in a special way,
making mapping of every page separately. However, if the buffer is not
aligned to page boundary (e.g. sub-array in a vmalloc-ed array), it
fills the scatter table with page-size unaligned pieces, that cross
page boundaries. This is incorrect and can, for example, cause memory
corruption and various crashes when working with ubifs on spi-nor chips.

Fix this by using proper scatter table size and intra-page buffer lengths,
so that the whole buffer splits into separate scatter table entries on
page boundaries.

Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
---
drivers/spi/spi.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 50910d8..14016dc 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -477,7 +477,9 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
{
const bool vmalloced_buf = is_vmalloc_addr(buf);
const int desc_len = vmalloced_buf ? PAGE_SIZE : master->max_dma_len;
- const int sgs = DIV_ROUND_UP(len, desc_len);
+ const int sgs = DIV_ROUND_UP(vmalloced_buf ?
+ len + offset_in_page(buf) : len,
+ desc_len);
struct page *vm_page;
void *sg_buf;
size_t min;
@@ -488,9 +490,10 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
return ret;

for (i = 0; i < sgs; i++) {
- min = min_t(size_t, len, desc_len);

if (vmalloced_buf) {
+ min = min_t(size_t,
+ len, desc_len - offset_in_page(buf));
vm_page = vmalloc_to_page(buf);
if (!vm_page) {
sg_free_table(sgt);
@@ -499,6 +502,7 @@ static int spi_map_buf(struct spi_master *master, struct device *dev,
sg_set_page(&sgt->sgl[i], vm_page,
min, offset_in_page(buf));
} else {
+ min = min_t(size_t, len, desc_len);
sg_buf = buf;
sg_set_buf(&sgt->sgl[i], sg_buf, min);
}
--
2.1.0


\
 
 \ /
  Last update: 2015-06-25 18:21    [W:0.026 / U:0.624 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site