spi: fix race freeing dummy_tx/rx before it is unmapped

commit 8e76ef88f607174082023f50b87fe12dcdbe5db5 upstream.

Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).

This results in the following messages:
  BUG: Bad page state in process
  page:db7ba030 count:0 mapcount:0 mapping:  (null) index:0x0
  flags: 0x200(arch_1)
  page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
  ...

Reported-by: Noralf Trønnes <noralf@tronnes.org>
Suggested-by: Noralf Trønnes <noralf@tronnes.org>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index d6563ec700d4f2c15001867edb28557162a56f53..f3e3ae8af709fae67840555b55dcb3e112ee68d7 100644 (file)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master)
 
        spin_lock_irqsave(&master->queue_lock, flags);
        mesg = master->cur_msg;
-       master->cur_msg = NULL;
-
-       queue_kthread_work(&master->kworker, &master->pump_messages);
        spin_unlock_irqrestore(&master->queue_lock, flags);
 
        if (master->cur_msg_prepared && master->unprepare_message) {
@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master)
                }
        }
 
-       trace_spi_message_done(mesg);
-
+       spin_lock_irqsave(&master->queue_lock, flags);
+       master->cur_msg = NULL;
        master->cur_msg_prepared = false;
+       queue_kthread_work(&master->kworker, &master->pump_messages);
+       spin_unlock_irqrestore(&master->queue_lock, flags);
+
+       trace_spi_message_done(mesg);
 
        mesg->state = NULL;
        if (mesg->complete)