From patchwork Mon Feb 17 17:20:37 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxime Ripard X-Patchwork-Id: 3664301 Return-Path: X-Original-To: patchwork-linux-spi@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 3980D9F370 for ; Mon, 17 Feb 2014 17:25:34 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 74F8920163 for ; Mon, 17 Feb 2014 17:25:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A54E62013D for ; Mon, 17 Feb 2014 17:25:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752282AbaBQRZF (ORCPT ); Mon, 17 Feb 2014 12:25:05 -0500 Received: from top.free-electrons.com ([176.31.233.9]:40347 "EHLO mail.free-electrons.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751976AbaBQRZE (ORCPT ); Mon, 17 Feb 2014 12:25:04 -0500 Received: by mail.free-electrons.com (Postfix, from userid 106) id B200E6E7; Mon, 17 Feb 2014 18:25:16 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 Received: from localhost (col31-4-88-188-83-94.fbx.proxad.net [88.188.83.94]) by mail.free-electrons.com (Postfix) with ESMTPSA id 5011A61B; Mon, 17 Feb 2014 18:25:16 +0100 (CET) From: Maxime Ripard To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, kevin.z.m.zh@gmail.com, sunny@allwinnertech.com, shuge@allwinnertech.com, zhuzhenhua@allwinnertech.com, Maxime Ripard , stable@vger.kernel.org Subject: [PATCH] spi: core: Fix Oops in spi_pump_messages error path Date: Mon, 17 Feb 2014 18:20:37 +0100 Message-Id: <1392657637-5297-1-git-send-email-maxime.ripard@free-electrons.com> X-Mailer: git-send-email 1.8.4.2 Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When the generic implementation of the transfer_one_message callback was called by the spi_pump_messages function, if that transfer was to fail, the spi_finalize_current_message was called twice, once in spi_transfer_one_message, and one in spi_pump_messages. This was causing a null pointer dereference in the second call, because the first one set the ->cur_msg field to NULL. Since the SPI framework expect the transfer_one_message callback to call spi_finalize_current_message, we can remove it from spi_pump_messages, together with any dereference of the ->cur_msg pointer. Signed-off-by: Maxime Ripard Cc: stable@vger.kernel.org --- drivers/spi/spi.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 23756b0..39f12be 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -756,8 +756,6 @@ static void spi_pump_messages(struct kthread_work *work) if (ret) { dev_err(&master->dev, "failed to transfer one message from queue: %d\n", ret); - master->cur_msg->status = ret; - spi_finalize_current_message(master); return; } }