From: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com
Copying the bus sdw_defer structure into the Cadence internals leads to using stale pointers and kernel oopses on errors. It's just simpler and safer to use the bus sdw_defer structure directly.
Link: https://github.com/thesofproject/linux/issues/4056 Signed-off-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com Reviewed-by: Ranjani Sridharan ranjani.sridharan@linux.intel.com Signed-off-by: Bard Liao yung-chuan.liao@linux.intel.com --- drivers/soundwire/bus.c | 2 +- drivers/soundwire/cadence_master.c | 17 ++++++++--------- drivers/soundwire/cadence_master.h | 5 +---- include/linux/soundwire/sdw.h | 3 +-- 4 files changed, 11 insertions(+), 16 deletions(-)
diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c index 572cc9a9af41..fc192d0c61e7 100644 --- a/drivers/soundwire/bus.c +++ b/drivers/soundwire/bus.c @@ -237,7 +237,7 @@ static inline int do_transfer_defer(struct sdw_bus *bus, init_completion(&defer->complete);
for (i = 0; i <= retry; i++) { - resp = bus->ops->xfer_msg_defer(bus, msg, defer); + resp = bus->ops->xfer_msg_defer(bus, msg); ret = find_response_code(resp); /* if cmd is ok or ignored return */ if (ret == 0 || ret == -ENODATA) diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c index 521387322145..2365395cb181 100644 --- a/drivers/soundwire/cadence_master.c +++ b/drivers/soundwire/cadence_master.c @@ -750,7 +750,7 @@ EXPORT_SYMBOL(cdns_xfer_msg);
enum sdw_command_response cdns_xfer_msg_defer(struct sdw_bus *bus, - struct sdw_msg *msg, struct sdw_defer *defer) + struct sdw_msg *msg) { struct sdw_cdns *cdns = bus_to_cdns(bus); int cmd = 0, ret; @@ -763,9 +763,6 @@ cdns_xfer_msg_defer(struct sdw_bus *bus, if (ret) return SDW_CMD_FAIL_OTHER;
- cdns->defer = defer; - cdns->defer->length = msg->len; - return _cdns_xfer_msg(cdns, msg, cmd, 0, msg->len, true); } EXPORT_SYMBOL(cdns_xfer_msg_defer); @@ -893,13 +890,15 @@ irqreturn_t sdw_cdns_irq(int irq, void *dev_id) return IRQ_NONE;
if (int_status & CDNS_MCP_INT_RX_WL) { + struct sdw_bus *bus = &cdns->bus; + struct sdw_defer *defer = &bus->defer_msg; + cdns_read_response(cdns);
- if (cdns->defer) { - cdns_fill_msg_resp(cdns, cdns->defer->msg, - cdns->defer->length, 0); - complete(&cdns->defer->complete); - cdns->defer = NULL; + if (defer && defer->msg) { + cdns_fill_msg_resp(cdns, defer->msg, + defer->length, 0); + complete(&defer->complete); } else { complete(&cdns->tx_complete); } diff --git a/drivers/soundwire/cadence_master.h b/drivers/soundwire/cadence_master.h index fa9dc38264a4..53029d22822d 100644 --- a/drivers/soundwire/cadence_master.h +++ b/drivers/soundwire/cadence_master.h @@ -109,7 +109,6 @@ struct sdw_cdns_dai_runtime { * @instance: instance number * @response_buf: SoundWire response buffer * @tx_complete: Tx completion - * @defer: Defer pointer * @ports: Data ports * @num_ports: Total number of data ports * @pcm: PCM streams @@ -130,7 +129,6 @@ struct sdw_cdns { u32 response_buf[CDNS_MCP_IP_MAX_CMD_LEN + 2];
struct completion tx_complete; - struct sdw_defer *defer;
struct sdw_cdns_port *ports; int num_ports; @@ -189,8 +187,7 @@ enum sdw_command_response cdns_xfer_msg(struct sdw_bus *bus, struct sdw_msg *msg);
enum sdw_command_response -cdns_xfer_msg_defer(struct sdw_bus *bus, - struct sdw_msg *msg, struct sdw_defer *defer); +cdns_xfer_msg_defer(struct sdw_bus *bus, struct sdw_msg *msg);
u32 cdns_read_ping_status(struct sdw_bus *bus);
diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h index 3cd2a761911f..fb2bd1524a26 100644 --- a/include/linux/soundwire/sdw.h +++ b/include/linux/soundwire/sdw.h @@ -852,8 +852,7 @@ struct sdw_master_ops { enum sdw_command_response (*xfer_msg) (struct sdw_bus *bus, struct sdw_msg *msg); enum sdw_command_response (*xfer_msg_defer) - (struct sdw_bus *bus, struct sdw_msg *msg, - struct sdw_defer *defer); + (struct sdw_bus *bus, struct sdw_msg *msg); enum sdw_command_response (*reset_page_addr) (struct sdw_bus *bus, unsigned int dev_num); int (*set_bus_conf)(struct sdw_bus *bus,