diff options
| author | Geert Uytterhoeven <geert+renesas@linux-m68k.org> | 2014-01-28 10:33:03 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-02-22 10:32:45 -0800 |
| commit | 566d9875cb708d907f8a0b3c2a0dffb96dcb973c (patch) | |
| tree | d4e5862a92812de5ed1a0ca8ebd2420237aa488d /drivers | |
| parent | 9558f9d82eed2e0015783c553794aeed79dfa0f8 (diff) | |
| download | lwn-566d9875cb708d907f8a0b3c2a0dffb96dcb973c.tar.gz lwn-566d9875cb708d907f8a0b3c2a0dffb96dcb973c.zip | |
spi: Fix crash with double message finalisation on error handling
commit 1f802f8249a0da536877842c43c7204064c4de8b upstream.
This reverts commit e120cc0dcf2880a4c5c0a6cb27b655600a1cfa1d.
It causes a NULL pointer dereference with drivers using the generic
spi_transfer_one_message(), which always calls
spi_finalize_current_message(), which zeroes master->cur_msg.
Drivers implementing transfer_one_message() theirselves must always call
spi_finalize_current_message(), even if the transfer failed:
* @transfer_one_message: the subsystem calls the driver to transfer a single
* message while queuing transfers that arrive in the meantime. When the
* driver is finished with this message, it must call
* spi_finalize_current_message() so the subsystem can issue the next
* transfer
Signed-off-by: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/spi/spi.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index b7a034a3259e..3d8f662e4fe9 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -572,9 +572,7 @@ static void spi_pump_messages(struct kthread_work *work) ret = master->transfer_one_message(master, master->cur_msg); if (ret) { dev_err(&master->dev, - "failed to transfer one message from queue: %d\n", ret); - master->cur_msg->status = ret; - spi_finalize_current_message(master); + "failed to transfer one message from queue\n"); return; } } |