1. 22 Feb, 2014 1 commit
    • Geert Uytterhoeven's avatar
      spi: Fix crash with double message finalisation on error handling · 69823005
      Geert Uytterhoeven authored
      commit 1f802f8249a0da536877842c43c7204064c4de8b upstream.
      
      This reverts commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d.
      
      It causes a NULL pointer dereference with drivers using the generic
      spi_transfer_one_message(), which always calls
      spi_finalize_current_message(), which zeroes master->cur_msg.
      
      Drivers implementing transfer_one_message() theirselves must always call
      spi_finalize_current_message(), even if the transfer failed:
      
       * @transfer_one_message: the subsystem calls the driver to transfer a single
       *      message while queuing transfers that arrive in the meantime. When the
       *      driver is finished with this message, it must call
       *      spi_finalize_current_message() so the subsystem can issue the next
       *      transfer
      Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@linux-m68k.org>
      Signed-off-by: default avatarMark Brown <broonie@linaro.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      69823005
  2. 13 Feb, 2014 2 commits
  3. 12 Aug, 2013 1 commit
  4. 21 Jun, 2013 1 commit
    • Mika Westerberg's avatar
      spi/pxa2xx: fix memory corruption due to wrong size used in devm_kzalloc() · cc0ee987
      Mika Westerberg authored
      ACPI part of the driver accidentally used sizeof(*ssp) instead of the
      correct sizeof(*pdata). This leads to nasty memory corruptions like the one
      below:
      
          BUG: unable to handle kernel paging request at 0000000749fd30b8
          IP: [<ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
          PGD 0
          Oops: 0000 [#1] PREEMPT SMP
          Modules linked in:
          CPU: 0 PID: 30 Comm: kworker/0:1 Not tainted 3.10.0-rc6v3.10-rc6_sdhci_modprobe+ #443
          task: ffff8801483a0940 ti: ffff88014839e000 task.ti: ffff88014839e000
          RIP: 0010:[<ffffffff813fe8a1>]  [<ffffffff813fe8a1>] __list_del_entry+0x31/0xd0
          RSP: 0000:ffff88014839fde8  EFLAGS: 00010046
          RAX: ffff880149fd30b0 RBX: ffff880149fd3040 RCX: dead000000200200
          RDX: 0000000749fd30b0 RSI: ffff880149fd3058 RDI: ffff88014834d640
          RBP: ffff88014839fde8 R08: ffff88014834d640 R09: 0000000000000001
          R10: ffff8801483a0940 R11: 0000000000000001 R12: ffff880149fd3040
          R13: ffffffff810e0b30 R14: ffff8801483a0940 R15: ffff88014834d640
          FS:  0000000000000000(0000) GS:ffff880149e00000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 0000000000000168 CR3: 0000000001e0b000 CR4: 00000000001407f0
          DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
          DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
          Stack:
           ffff88014839fe48 ffffffff810e0baf ffffffff81120abd ffff88014839fe20
           ffff8801483a0940 ffff8801483a0940 ffff8801483a0940 ffff8801486b1c90
           ffff88014834d640 ffffffff810e0b30 0000000000000000 0000000000000000
          Call Trace:
           [<ffffffff810e0baf>] worker_thread+0x7f/0x390
           [<ffffffff81120abd>] ? trace_hardirqs_on+0xd/0x10
           [<ffffffff810e0b30>] ? manage_workers.isra.22+0x2b0/0x2b0
           [<ffffffff810e6c09>] kthread+0xd9/0xe0
           [<ffffffff810f93df>] ? local_clock+0x3f/0x50
           [<ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110
           [<ffffffff818c5dec>] ret_from_fork+0x7c/0xb0
           [<ffffffff810e6b30>] ? kthread_create_on_node+0x110/0x110
      
      Fix this by using the right structure size in devm_kzalloc().
      Reported-by: default avatarJerome Blin <jerome.blin@intel.com>
      Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
      Signed-off-by: default avatarMark Brown <broonie@linaro.org>
      Cc: stable@vger.kernel.org # 3.9+
      cc0ee987
  5. 18 Jun, 2013 1 commit
  6. 10 Jun, 2013 1 commit
  7. 04 Jun, 2013 2 commits
  8. 22 May, 2013 1 commit
  9. 20 May, 2013 1 commit
  10. 18 May, 2013 1 commit
  11. 02 May, 2013 1 commit
  12. 28 Apr, 2013 1 commit
  13. 25 Apr, 2013 1 commit
  14. 24 Apr, 2013 1 commit
  15. 23 Apr, 2013 3 commits
  16. 18 Apr, 2013 3 commits
  17. 17 Apr, 2013 1 commit
  18. 16 Apr, 2013 2 commits
  19. 15 Apr, 2013 1 commit
  20. 12 Apr, 2013 1 commit
    • Arnd Bergmann's avatar
      spi: s3c64xx: move to generic dmaengine API · 78843727
      Arnd Bergmann authored
      The spi-s3c64xx uses a Samsung proprietary interface for
      talking to the DMA engine, which does not work with
      multiplatform kernels.
      
      This version of the patch leaves the old code in place,
      behind an #ifdef. This can be removed in the future,
      after the s3c64xx platform start supporting the regular
      dmaengine interface. An earlier version of this patch was
      tested successfully on exynos5250 by Padma Venkat.
      
      The conversion was rather mechanical, since the samsung
      interface is just a shallow wrapper around the dmaengine
      interface.
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      78843727
  21. 10 Apr, 2013 1 commit
  22. 09 Apr, 2013 2 commits
  23. 08 Apr, 2013 3 commits
  24. 07 Apr, 2013 7 commits