From patchwork Fri Dec 21 12:11:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Kocialkowski X-Patchwork-Id: 10740361 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4B537161F for ; Fri, 21 Dec 2018 12:12:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3528128725 for ; Fri, 21 Dec 2018 12:12:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 178E02872B; Fri, 21 Dec 2018 12:12:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id AE88528725 for ; Fri, 21 Dec 2018 12:12:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=KmdsNO3lIDdTgrKyyYFBzFCQNiSB4umK69WP6710ZpE=; b=A0kKoi3PShYXMl PGp1qe4lZex9Oei0kDruLWy/INp4JDrcFpF2MNwgkgsP8RLN1hA39nOOJMIb43H7LW0HbFAM6Mx2s 1A6/0Xy1sWYBOgmwBjot0ZVJobuCA+stFTE3AIcWGtaCRuaiGMWOl+0qI8gi+zmkqnNT5exua7rz1 MHx3CyQhs8UudE0bXEk5r0YfiZxLhkE3EB0hWZMaWziBByMg4wcTVoyTBJMs2IA+Z2yMLHKkDGHOy R5cL8APhkUqWKnnJIvFiqYXYb/hdzs8kgmEAxJ9OoS/s3OhOMIcbfcZOSnP7yWzAE0Xxju5u0bS9X 2P+g68U7xHIdSlwERDyQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gaJfH-0001WX-JD; Fri, 21 Dec 2018 12:12:27 +0000 Received: from mail.bootlin.com ([62.4.15.54]) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1gaJfE-0001V5-M6; Fri, 21 Dec 2018 12:12:26 +0000 Received: by mail.bootlin.com (Postfix, from userid 110) id 103EB207AE; Fri, 21 Dec 2018 13:12:07 +0100 (CET) Received: from localhost.localdomain (aaubervilliers-681-1-38-38.w90-88.abo.wanadoo.fr [90.88.157.38]) by mail.bootlin.com (Postfix) with ESMTPSA id B13DB2078E; Fri, 21 Dec 2018 13:12:06 +0100 (CET) From: Paul Kocialkowski To: bcm-kernel-feedback-list@broadcom.com, linux-i2c@vger.kernel.org, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] i2c: bcm2835: Clear current message and count after a transaction Date: Fri, 21 Dec 2018 13:11:35 +0100 Message-Id: <20181221121135.4847-1-paul.kocialkowski@bootlin.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20181221_041224_855529_EC0E5970 X-CRM114-Status: GOOD ( 13.67 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Stefan Wahren , Florian Fainelli , Scott Branden , Ray Jui , Paul Kocialkowski , Eric Anholt Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP The driver's interrupt handler checks whether a message is currently being handled with the curr_msg pointer. When it is NULL, the interrupt is considered to be unexpected. Similarly, the i2c_start_transfer routine checks for the remaining number of messages to handle in num_msgs. However, these values are never cleared and always keep the message and number relevant to the latest transfer (which might be done already and the underlying message memory might have been freed). When an unexpected interrupt hits with the DONE bit set, the isr will then try to access the flags field of the curr_msg structure, leading to a fatal page fault. Fix the issue by systematically clearing curr_msg and num_msgs in the driver-wide device structure when a transfer is considered complete. Signed-off-by: Paul Kocialkowski --- drivers/i2c/busses/i2c-bcm2835.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c index 44deae78913e..5486252f5f2f 100644 --- a/drivers/i2c/busses/i2c-bcm2835.c +++ b/drivers/i2c/busses/i2c-bcm2835.c @@ -298,6 +298,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], return -ETIMEDOUT; } + i2c_dev->curr_msg = NULL; + i2c_dev->num_msgs = 0; + if (!i2c_dev->msg_err) return num;