diff options
| author | Nobuteru Hayashi <hayashi.nbb@ncos.nec.co.jp> | 2016-03-18 11:35:21 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2016-03-28 19:41:18 +0100 |
| commit | 6319a68011b86fa61dc63e94dc4fb716628037f3 (patch) | |
| tree | 2dbe35310b327e166e31cdc4f0e4752ce7889cbb /drivers/spi/spi-fsl-espi.c | |
| parent | aa70e567c4f0eeb849c6bcef3685bdf1fc3ca19d (diff) | |
| download | lwn-6319a68011b86fa61dc63e94dc4fb716628037f3.tar.gz lwn-6319a68011b86fa61dc63e94dc4fb716628037f3.zip | |
spi/fsl-espi: avoid infinite loops on fsl_espi_cpu_irq()
It brought nearly infinite loops, and was possible to be
occurred only if the SPI transaction total size are not
alighed with 4. Loops are here at while (tmp--),
tmp is unsigned, and set it with minus value.
The loops are executed as a result of unexpected RX interrupt
occurrence after that. This interrupt may be hardware eratta
and is not fixed.
Fix mspi->len from minus value to 0 and print warning message.
Signed-off-by: Nobuteru Hayashi <hayashi.nbb@ncos.nec.co.jp>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi/spi-fsl-espi.c')
| -rw-r--r-- | drivers/spi/spi-fsl-espi.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c index 64d794b99803..8d85a3c343da 100644 --- a/drivers/spi/spi-fsl-espi.c +++ b/drivers/spi/spi-fsl-espi.c @@ -544,6 +544,7 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events) if (events & SPIE_NE) { u32 rx_data, tmp; u8 rx_data_8; + int rx_nr_bytes = 4; int ret; /* Spin until RX is done */ @@ -560,7 +561,14 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events) if (mspi->len >= 4) { rx_data = mpc8xxx_spi_read_reg(®_base->receive); + } else if (mspi->len <= 0) { + dev_err(mspi->dev, + "unexpected RX(SPIE_NE) interrupt occurred,\n" + "(local rxlen %d bytes, reg rxlen %d bytes)\n", + min(4, mspi->len), SPIE_RXCNT(events)); + rx_nr_bytes = 0; } else { + rx_nr_bytes = mspi->len; tmp = mspi->len; rx_data = 0; while (tmp--) { @@ -571,7 +579,7 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events) rx_data <<= (4 - mspi->len) * 8; } - mspi->len -= 4; + mspi->len -= rx_nr_bytes; if (mspi->rx) mspi->get_rx(rx_data, mspi); |