From: Paul Kocialkowski <paul.kocialkowski@bootlin.com> To: bcm-kernel-feedback-list@broadcom.com, linux-i2c@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Florian Fainelli <f.fainelli@gmail.com>, Ray Jui <rjui@broadcom.com>, Scott Branden <sbranden@broadcom.com>, Eric Anholt <eric@anholt.net>, Stefan Wahren <stefan.wahren@i2se.com>, Paul Kocialkowski <paul.kocialkowski@bootlin.com> Subject: [PATCH] i2c: bcm2835: Clear current message and count after a transaction Date: Fri, 21 Dec 2018 13:11:35 +0100 [thread overview] Message-ID: <20181221121135.4847-1-paul.kocialkowski@bootlin.com> (raw) The driver's interrupt handler checks whether a message is currently being handled with the curr_msg pointer. When it is NULL, the interrupt is considered to be unexpected. Similarly, the i2c_start_transfer routine checks for the remaining number of messages to handle in num_msgs. However, these values are never cleared and always keep the message and number relevant to the latest transfer (which might be done already and the underlying message memory might have been freed). When an unexpected interrupt hits with the DONE bit set, the isr will then try to access the flags field of the curr_msg structure, leading to a fatal page fault. Fix the issue by systematically clearing curr_msg and num_msgs in the driver-wide device structure when a transfer is considered complete. Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> --- drivers/i2c/busses/i2c-bcm2835.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c index 44deae78913e..5486252f5f2f 100644 --- a/drivers/i2c/busses/i2c-bcm2835.c +++ b/drivers/i2c/busses/i2c-bcm2835.c @@ -298,6 +298,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], return -ETIMEDOUT; } + i2c_dev->curr_msg = NULL; + i2c_dev->num_msgs = 0; + if (!i2c_dev->msg_err) return num; -- 2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: Paul Kocialkowski <paul.kocialkowski@bootlin.com> To: bcm-kernel-feedback-list@broadcom.com, linux-i2c@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Stefan Wahren <stefan.wahren@i2se.com>, Florian Fainelli <f.fainelli@gmail.com>, Scott Branden <sbranden@broadcom.com>, Ray Jui <rjui@broadcom.com>, Paul Kocialkowski <paul.kocialkowski@bootlin.com>, Eric Anholt <eric@anholt.net> Subject: [PATCH] i2c: bcm2835: Clear current message and count after a transaction Date: Fri, 21 Dec 2018 13:11:35 +0100 [thread overview] Message-ID: <20181221121135.4847-1-paul.kocialkowski@bootlin.com> (raw) The driver's interrupt handler checks whether a message is currently being handled with the curr_msg pointer. When it is NULL, the interrupt is considered to be unexpected. Similarly, the i2c_start_transfer routine checks for the remaining number of messages to handle in num_msgs. However, these values are never cleared and always keep the message and number relevant to the latest transfer (which might be done already and the underlying message memory might have been freed). When an unexpected interrupt hits with the DONE bit set, the isr will then try to access the flags field of the curr_msg structure, leading to a fatal page fault. Fix the issue by systematically clearing curr_msg and num_msgs in the driver-wide device structure when a transfer is considered complete. Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> --- drivers/i2c/busses/i2c-bcm2835.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c index 44deae78913e..5486252f5f2f 100644 --- a/drivers/i2c/busses/i2c-bcm2835.c +++ b/drivers/i2c/busses/i2c-bcm2835.c @@ -298,6 +298,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], return -ETIMEDOUT; } + i2c_dev->curr_msg = NULL; + i2c_dev->num_msgs = 0; + if (!i2c_dev->msg_err) return num; -- 2.20.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2018-12-21 12:12 UTC|newest] Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-12-21 12:11 Paul Kocialkowski [this message] 2018-12-21 12:11 ` [PATCH] i2c: bcm2835: Clear current message and count after a transaction Paul Kocialkowski 2018-12-21 17:52 ` Florian Fainelli 2018-12-21 17:52 ` Florian Fainelli 2018-12-24 8:54 ` Paul Kocialkowski 2018-12-24 8:54 ` Paul Kocialkowski 2018-12-22 12:19 ` Stefan Wahren 2018-12-22 12:19 ` Stefan Wahren 2018-12-22 12:19 ` Stefan Wahren 2018-12-24 9:10 ` Paul Kocialkowski 2018-12-24 9:10 ` Paul Kocialkowski 2018-12-27 14:05 ` Stefan Wahren 2018-12-27 14:05 ` Stefan Wahren 2018-12-27 14:05 ` Stefan Wahren 2018-12-27 15:10 ` Paul Kocialkowski 2018-12-27 15:10 ` Paul Kocialkowski 2018-12-27 18:15 ` Eric Anholt 2018-12-27 18:15 ` Eric Anholt 2018-12-28 15:06 ` Stefan Wahren 2018-12-28 15:06 ` Stefan Wahren 2018-12-28 15:06 ` Stefan Wahren
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20181221121135.4847-1-paul.kocialkowski@bootlin.com \ --to=paul.kocialkowski@bootlin.com \ --cc=bcm-kernel-feedback-list@broadcom.com \ --cc=eric@anholt.net \ --cc=f.fainelli@gmail.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-i2c@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-rpi-kernel@lists.infradead.org \ --cc=rjui@broadcom.com \ --cc=sbranden@broadcom.com \ --cc=stefan.wahren@i2se.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.