From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Liwei Song <liwei.song@windriver.com>,
Andy Shevchenko <andy.shevchenko@gmail.com>,
Wolfram Sang <wsa@the-dreams.de>
Subject: [PATCH 4.4 04/13] i2c: ismt: fix wrong device address when unmap the data buffer
Date: Thu, 16 Aug 2018 20:41:51 +0200 [thread overview]
Message-ID: <20180816171628.753777777@linuxfoundation.org> (raw)
In-Reply-To: <20180816171628.554317013@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liwei Song <liwei.song@windriver.com>
commit 17e83549e199d89aace7788a9f11c108671eecf5 upstream.
Fix the following kernel bug:
kernel BUG at drivers/iommu/intel-iommu.c:3260!
invalid opcode: 0000 [#5] PREEMPT SMP
Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016
task: ffff880175389950 ti: ffff880176bec000 task.ti: ffff880176bec000
RIP: 0010:[<ffffffff8150a83b>] [<ffffffff8150a83b>] intel_unmap+0x25b/0x260
RSP: 0018:ffff880176bef5e8 EFLAGS: 00010296
RAX: 0000000000000024 RBX: ffff8800773c7c88 RCX: 000000000000ce04
RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000009
RBP: ffff880176bef638 R08: 0000000000000010 R09: 0000000000000004
R10: ffff880175389c78 R11: 0000000000000a4f R12: ffff8800773c7868
R13: 00000000ffffac88 R14: ffff8800773c7818 R15: 0000000000000001
FS: 00007fef21258700(0000) GS:ffff88017b5c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066d6d8 CR3: 000000007118c000 CR4: 00000000003406e0
Stack:
00000000ffffac88 ffffffff8199867f ffff880176bef5f8 ffff880100000030
ffff880176bef668 ffff8800773c7c88 ffff880178288098 ffff8800772c0010
ffff8800773c7818 0000000000000001 ffff880176bef648 ffffffff8150a86e
Call Trace:
[<ffffffff8199867f>] ? printk+0x46/0x48
[<ffffffff8150a86e>] intel_unmap_page+0xe/0x10
[<ffffffffa039d99b>] ismt_access+0x27b/0x8fa [i2c_ismt]
[<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
[<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
[<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
[<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
[<ffffffff8143dfd0>] ? pci_bus_read_dev_vendor_id+0xf0/0xf0
[<ffffffff8172b36c>] i2c_smbus_xfer+0xec/0x4b0
[<ffffffff810aa4d5>] ? vprintk_emit+0x345/0x530
[<ffffffffa038936b>] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev]
[<ffffffff810aa829>] ? vprintk_default+0x29/0x40
[<ffffffffa0389b33>] i2cdev_ioctl+0x63/0x1ec [i2c_dev]
[<ffffffff811b04c8>] do_vfs_ioctl+0x328/0x5d0
[<ffffffff8119d8ec>] ? vfs_write+0x11c/0x190
[<ffffffff8109d449>] ? rt_up_read+0x19/0x20
[<ffffffff811b07f1>] SyS_ioctl+0x81/0xa0
[<ffffffff819a351b>] system_call_fastpath+0x16/0x6e
This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter.
After finished I2C block read/write, when unmap the data buffer,
a wrong device address was pass to dma_unmap_single().
To fix this, give dma_unmap_single() the "dev" parameter, just like
what dma_map_single() does, then unmap can find the right devices.
Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller")
Signed-off-by: Liwei Song <liwei.song@windriver.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-ismt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -587,7 +587,7 @@ static int ismt_access(struct i2c_adapte
/* unmap the data buffer */
if (dma_size != 0)
- dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
+ dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
if (unlikely(!time_left)) {
dev_err(dev, "completion wait timed out\n");
next prev parent reply other threads:[~2018-08-16 18:43 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-16 18:41 [PATCH 4.4 00/13] 4.4.149-stable review Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 01/13] x86/mm: Disable ioremap free page handling on x86-PAE Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 02/13] tcp: Fix missing range_truesize enlargement in the backport Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 03/13] kasan: dont emit builtin calls when sanitization is off Greg Kroah-Hartman
2018-08-16 18:41 ` Greg Kroah-Hartman [this message]
2018-08-16 18:41 ` [PATCH 4.4 05/13] kbuild: verify that $DEPMOD is installed Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 06/13] crypto: vmac - require a block cipher with 128-bit block size Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 07/13] crypto: vmac - separate tfm and request context Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 08/13] crypto: blkcipher - fix crash flushing dcache in error path Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 09/13] crypto: ablkcipher " Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 10/13] ASoC: Intel: cht_bsw_max98090_ti: Fix jack initialization Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 11/13] Bluetooth: hidp: buffer overflow in hidp_process_report Greg Kroah-Hartman
2018-08-16 18:41 ` [PATCH 4.4 12/13] ioremap: Update pgtable free interfaces with addr Greg Kroah-Hartman
2018-08-16 18:42 ` [PATCH 4.4 13/13] x86/mm: Add TLB purge to free pmd/pte page interfaces Greg Kroah-Hartman
2018-08-17 17:17 ` [PATCH 4.4 00/13] 4.4.149-stable review Guenter Roeck
2018-08-18 15:30 ` Rafael David Tinoco
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180816171628.753777777@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andy.shevchenko@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=liwei.song@windriver.com \
--cc=stable@vger.kernel.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).