linux/drivers/i2c
Paul Kocialkowski f275a46594 i2c: bcm2835: Clear current buffer pointers and counts after a transfer
The driver's interrupt handler checks whether a message is currently
being handled with the curr_msg pointer. When it is NULL, the interrupt
is considered to be unexpected. Similarly, the i2c_start_transfer
routine checks for the remaining number of messages to handle in
num_msgs.

However, these values are never cleared and always keep the message and
number relevant to the latest transfer (which might be done already and
the underlying message memory might have been freed).

When an unexpected interrupt hits with the DONE bit set, the isr will
then try to access the flags field of the curr_msg structure, leading
to a fatal page fault.

The msg_buf and msg_buf_remaining fields are also never cleared at the
end of the transfer, which can lead to similar pitfalls.

Fix these issues by introducing a cleanup function and always calling
it after a transfer is finished.

Fixes: e247454103 ("i2c: bcm2835: Fix hang for writing messages larger than 16 bytes")
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
2019-02-15 09:45:05 +01:00
..
algos i2c: algos: bit: make the error messages grepable 2018-08-30 23:11:42 +02:00
busses i2c: bcm2835: Clear current buffer pointers and counts after a transfer 2019-02-15 09:45:05 +01:00
muxes Merge branch 'i2c/for-4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-10-29 14:44:03 -07:00
i2c-boardinfo.c i2c: i2c-boardinfo: fix memory leaks on devinfo 2017-11-27 19:14:29 +01:00
i2c-core-acpi.c i2c: acpi: Introduce i2c_acpi_get_i2c_resource() helper 2018-12-03 21:40:02 +02:00
i2c-core-base.c i2c: Clear client->irq in i2c_device_remove 2018-10-31 23:33:34 +00:00
i2c-core-of.c i2c: Export of_i2c_get_board_info() 2018-05-22 13:42:16 +02:00
i2c-core-slave.c i2c: remove i2c_lock_adapter and use i2c_lock_bus directly 2018-07-13 00:09:37 +02:00
i2c-core-smbus.c i2c: smbus: add unlocked __i2c_smbus_xfer variant 2018-07-20 23:51:37 +02:00
i2c-core.h i2c: make i2c_check_addr_validity() static 2018-03-24 14:07:23 +01:00
i2c-dev.c i2c: dev: prevent adapter retries and timeout being set as minus value 2019-01-11 00:14:55 +01:00
i2c-mux.c Merge branch 'i2c/for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-08-21 17:40:46 -07:00
i2c-slave-eeprom.c i2c: Drop owner assignment from i2c_driver 2015-08-10 08:37:35 +02:00
i2c-smbus.c i2c: i2c-smbus: add of_i2c_setup_smbus_alert 2017-10-28 23:42:47 +02:00
i2c-stub.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
Kconfig treewide: surround Kconfig file paths with double quotes 2018-12-22 00:25:54 +09:00
Makefile i2c: don't use any __deprecated handling anymore 2018-08-24 17:26:43 +02:00