On Thu, Dec 04, 2014 at 10:01:06PM +0100, Robert Jarzmik wrote: > Mika Westerberg <mika.westerb...@linux.intel.com> writes: > > > Once the current message is finished, the driver notifies SPI core about > > this by calling spi_finalize_current_message(). This function queues next > > message to be transferred. If there are more messages in the queue, it is > > possible that the driver is asked to transfer the next message at this > > point. > > > > When spi_finalize_current_message() returns the driver clears the > > drv_data->cur_chip pointer to NULL. The problem is that if the driver > > already started the next message clearing drv_data->cur_chip will cause > > NULL pointer dereference which crashes the kernel like: > ..zip.. > > Fix this by clearing drv_data->cur_chip before we call > > spi_finalize_current_message(). > > So with your change, we have : > drv_data->cur_chip = NULL; > spi_finalize_current_message(drv_data->master); > > In that case, if spi_finalize_current_message() queues another message, upon > this next message completion, won't giveback() be called, and dereference > cur_chip as well ?
When the next message is started pxa2xx_spi_transfer_one_message() gets called and that will set cur_chip again. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
