lkml.org 
[lkml]   [2014]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 018/143] i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Simon Lindgren <simon@aqwary.com>

    commit 6721f28a26efd6368497abbdef5dcfc59608d899 upstream.

    There is a race condition in at91_do_twi_xfer when signals arrive.
    If a signal is recieved while waiting for a transfer to complete
    wait_for_completion_interruptible_timeout() will return -ERESTARTSYS.
    This is not handled correctly resulting in interrupts still being
    enabled and a transfer being in flight when we return.

    Symptoms include a range of oopses and bus lockups. Oopses can happen
    when the transfer completes because the interrupt handler will corrupt
    the stack. If a new transfer is started before the interrupt fires
    the controller will start a new transfer in the middle of the old one,
    resulting in confused slaves and a locked bus.

    To avoid this, use wait_for_completion_io_timeout instead so that we
    don't have to deal with gracefully shutting down the transfer and
    disabling the interrupts.

    Signed-off-by: Simon Lindgren <simon@aqwary.com>
    Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/i2c/busses/i2c-at91.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/i2c/busses/i2c-at91.c
    +++ b/drivers/i2c/busses/i2c-at91.c
    @@ -435,8 +435,8 @@ static int at91_do_twi_transfer(struct a
    }
    }

    - ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
    - dev->adapter.timeout);
    + ret = wait_for_completion_io_timeout(&dev->cmd_complete,
    + dev->adapter.timeout);
    if (ret == 0) {
    dev_err(dev->dev, "controller timed out\n");
    at91_init_twi_bus(dev);



    \
     
     \ /
      Last update: 2014-10-04 01:41    [W:4.215 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site