From patchwork Tue Aug 26 19:13:24 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Lindgren X-Patchwork-Id: 383191 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 1B2D41400D7 for ; Wed, 27 Aug 2014 05:14:28 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752272AbaHZTOM (ORCPT ); Tue, 26 Aug 2014 15:14:12 -0400 Received: from mail-la0-f47.google.com ([209.85.215.47]:54507 "EHLO mail-la0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751989AbaHZTOL (ORCPT ); Tue, 26 Aug 2014 15:14:11 -0400 Received: by mail-la0-f47.google.com with SMTP id mc6so15734632lab.34 for ; Tue, 26 Aug 2014 12:14:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=wKlo20sbGaHsnmkgIL2HTd0dsuwrjUNvvsmxtr+4QHY=; b=JllDAsJsOXSq3xZL3X+ozzKKdcXxiscANM455yYwAjFK8zZtnIfRG9dbYFAVY1NowF 2UTDlzdJDGLGRG0HfBPAhZ285741n9gRNsyMOOp9zCl7ksJWhtR17FvzsXcSTJ5OWYjZ tPm+HGEZS7z3nOfxLkXxLXNKoJ6ntqp/rjkZMo/33WKBYHasJC64CPvSMxuLBmD0+Ro5 klVqguIYW/a+8t/24l9yzNx0SN9/z6uVeAwDyZpq7roUwyEJl1olW+A2XP8PKxv868J3 l8IvdqaQCei/gHolUHT1HYbg4z6RUsqwlpxT5fy0N3uxG3UnWx+W8Zch9tUdoQ6dmetF uH5w== X-Gm-Message-State: ALoCoQnGmCZ7WVblIOvGI2aq/9zy5mzKHI8F4WDxFqQiDnNLPfz1M4T+hE5MGW19iSUkPmqiFDGi X-Received: by 10.112.73.164 with SMTP id m4mr27963712lbv.3.1409080448954; Tue, 26 Aug 2014 12:14:08 -0700 (PDT) Received: from localhost.localdomain ([94.136.92.143]) by mx.google.com with ESMTPSA id x1sm2616008lal.19.2014.08.26.12.14.07 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 26 Aug 2014 12:14:08 -0700 (PDT) From: Simon Lindgren To: wsa@the-dreams.de Cc: ludovic.desroches@atmel.com, linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org, Simon Lindgren Subject: [PATCH] i2c:at91: Fix a race condition during signal handling in at91_do_twi_xfer. Date: Tue, 26 Aug 2014 21:13:24 +0200 Message-Id: <1409080404-19069-1-git-send-email-simon@aqwary.com> X-Mailer: git-send-email 1.7.9.5 Sender: linux-i2c-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-i2c@vger.kernel.org There is a race condition in at91_do_twi_xfer when signals arrive. If a signal is recieved while waiting for a transfer to complete wait_for_completion_interruptible_timeout() will return -ERESTARTSYS. This is not handled correctly resulting in interrupts still being enabled and a transfer being in flight when we return. Symptoms include a range of oopses and bus lockups. Oopses can happen when the transfer completes because the interrupt handler will corrupt the stack. If a new transfer is started before the interrupt fires the controller will start a new transfer in the middle of the old one, resulting in confused slaves and a locked bus. To avoid this, use wait_for_completion_io_timeout instead so that we don't have to deal with gracefully shutting down the transfer and disabling the interrupts. Signed-off-by: Simon Lindgren Acked-by: Ludovic Desroches --- drivers/i2c/busses/i2c-at91.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c index 79a6899..ec299ae 100644 --- a/drivers/i2c/busses/i2c-at91.c +++ b/drivers/i2c/busses/i2c-at91.c @@ -421,8 +421,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev) } } - ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete, - dev->adapter.timeout); + ret = wait_for_completion_io_timeout(&dev->cmd_complete, + dev->adapter.timeout); if (ret == 0) { dev_err(dev->dev, "controller timed out\n"); at91_init_twi_bus(dev);