Messages in this thread | | | From | Robert Jarzmik <> | Subject | Re: [PATCH] spi/pxa2xx: Clear cur_chip pointer before starting next message | Date | Thu, 04 Dec 2014 22:01:06 +0100 |
| |
Mika Westerberg <mika.westerberg@linux.intel.com> writes:
> Once the current message is finished, the driver notifies SPI core about > this by calling spi_finalize_current_message(). This function queues next > message to be transferred. If there are more messages in the queue, it is > possible that the driver is asked to transfer the next message at this > point. > > When spi_finalize_current_message() returns the driver clears the > drv_data->cur_chip pointer to NULL. The problem is that if the driver > already started the next message clearing drv_data->cur_chip will cause > NULL pointer dereference which crashes the kernel like: ..zip.. > Fix this by clearing drv_data->cur_chip before we call > spi_finalize_current_message().
So with your change, we have : drv_data->cur_chip = NULL; spi_finalize_current_message(drv_data->master);
In that case, if spi_finalize_current_message() queues another message, upon this next message completion, won't giveback() be called, and dereference cur_chip as well ?
Cheers.
-- Robert
| |