spi: fix race freeing dummy_tx/rx before it is unmapped
authorMartin Sperl <kernel@martin.sperl.org>
Sun, 10 May 2015 07:50:45 +0000 (07:50 +0000)
committerMark Brown <broonie@kernel.org>
Mon, 11 May 2015 18:05:27 +0000 (19:05 +0100)
commit8e76ef88f607174082023f50b87fe12dcdbe5db5
tree080e56d5f05011b769a1b64db8ac0a5d76c6eea1
parentf8bb820da4ae863c676156627973a950129559fb
spi: fix race freeing dummy_tx/rx before it is unmapped

Fix a race (with some kernel configurations) where a queued
master->pump_messages runs and frees dummy_tx/rx before
spi_unmap_msg is running (or is finished).

This results in the following messages:
  BUG: Bad page state in process
  page:db7ba030 count:0 mapcount:0 mapping:  (null) index:0x0
  flags: 0x200(arch_1)
  page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
  ...

Reported-by: Noralf Trønnes <noralf@tronnes.org>
Suggested-by: Noralf Trønnes <noralf@tronnes.org>
Tested-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
drivers/spi/spi.c