From f98b9a26fe08f7f9d7fb26ee3d9f167f79b2f6b6 Mon Sep 17 00:00:00 2001 From: Javi Merino Date: Wed, 21 Dec 2011 11:19:00 +0100 Subject: [PATCH] ARM: 7242/1: PL330: Detach the request from the pl330_thread when it finishes successful When a request has finished successfully and we are about to call its callback, remove its pointer from the corresponding pl330_thread . This prevents the core driver from calling its callback again if pl330_release_channel() is called without first flushing the device. When pl330_update() returns, the driver is allowed to free the pointer to pl330_req so the core driver shouldn't be able to access it again. Reference: Signed-off-by: Javi Merino Acked-by: Jassi Brar Signed-off-by: Russell King --- arch/arm/common/pl330.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c index 8d8df74..d8e44a4 100644 --- a/arch/arm/common/pl330.c +++ b/arch/arm/common/pl330.c @@ -1467,13 +1467,19 @@ int pl330_update(const struct pl330_info *pi) /* Now that we are in no hurry, do the callbacks */ while (!list_empty(&pl330->req_done)) { + struct pl330_req *r; + rqdone = container_of(pl330->req_done.next, struct _pl330_req, rqd); list_del_init(&rqdone->rqd); + /* Detach the req */ + r = rqdone->r; + rqdone->r = NULL; + spin_unlock_irqrestore(&pl330->lock, flags); - _callback(rqdone->r, PL330_ERR_NONE); + _callback(r, PL330_ERR_NONE); spin_lock_irqsave(&pl330->lock, flags); } -- 2.7.4