ARM: OMAP: mcbsp: Fix possible memory corruption

PATCH New Jarkko Nikula 4 participants 8 messages Dec 12, 2011 – Dec 14, 2011

Subsystems (3)

Arm (32-bit) Arm sub-architectures OMAP2+ support

lore

Share & tools

lore

Jarkko Nikula

author

2011-12-12 08:36 UTC #0 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Commits 09d28d ("ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src") and 7bc0c4 ("ARM: OMAP: mcbsp: Start generalize signal muxing functions") incorrectly set two struct omap_mcbsp_platform_data fields after omap_device_build_ss and kfree calls.

Fix this by moving these pdata assignments before those calls.

Signed-off-by Jarkko Nikula <[email protected]>

Reported-by neilb at suse.de

---
For 3.2, 3.1 is ok.

---
 arch/arm/mach-omap2/mcbsp.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

arch/arm/mach-omap2/mcbsp.c +3 -3

index 292eee3..28fcb27 100644
@@ -145,6 +145,9 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 		pdata->reg_size = 4;
 		pdata->has_ccr = true;
 	}
+	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
+	if (id == 1)
+		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 
 	if (oh->class->rev == MCBSP_CONFIG_TYPE3) {
 		if (id == 2)

@@ -174,9 +177,6 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 					name, oh->name);
 		return PTR_ERR(pdev);
 	}
-	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
-	if (id == 1)
-		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 	omap_mcbsp_count++;
 	return 0;
 }

Signature · 1 line

1.7.7.3

Jarkko Nikula

author

2011-12-12 08:38 UTC #1 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Fix this by moving these pdata assignments before those calls.

Signed-off-by Jarkko Nikula <[email protected]>

Reported-by neilb at suse.de

---
For 3.2, 3.1 is ok.

---
 arch/arm/mach-omap2/mcbsp.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

arch/arm/mach-omap2/mcbsp.c +3 -3

index 292eee3..28fcb27 100644
@@ -145,6 +145,9 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 		pdata->reg_size = 4;
 		pdata->has_ccr = true;
 	}
+	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
+	if (id == 1)
+		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 
 	if (oh->class->rev == MCBSP_CONFIG_TYPE3) {
 		if (id == 2)

@@ -174,9 +177,6 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 					name, oh->name);
 		return PTR_ERR(pdev);
 	}
-	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
-	if (id == 1)
-		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 	omap_mcbsp_count++;
 	return 0;
 }

Signature · 1 line

1.7.7.3

Igor Grinberg

2011-12-12 10:23 UTC #2 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 9 lines · Jarkko Nikula

Commits 09d28d ("ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src") and 7bc0c4 ("ARM: OMAP: mcbsp: Start generalize signal muxing functions") incorrectly set two struct omap_mcbsp_platform_data fields after omap_device_build_ss and kfree calls.
Fix this by moving these pdata assignments before those calls.
Signed-off-by Jarkko Nikula <[email protected]>
Reported-by neilb at suse.de

Perhaps, should be:

Reported-by NeilBrown <[email protected]>

and
Cc: <[email protected]> [3.1]
as for below.

Quoted 30 lines

---
For 3.2, 3.1 is ok.

---
 arch/arm/mach-omap2/mcbsp.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

arch/arm/mach-omap2/mcbsp.c +3 -3

index 292eee3..28fcb27 100644
@@ -145,6 +145,9 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 		pdata->reg_size = 4;
 		pdata->has_ccr = true;
 	}
+	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
+	if (id == 1)
+		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 
 	if (oh->class->rev == MCBSP_CONFIG_TYPE3) {
 		if (id == 2)

@@ -174,9 +177,6 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
 					name, oh->name);
 		return PTR_ERR(pdev);
 	}
-	pdata->set_clk_src = omap2_mcbsp_set_clk_src;
-	if (id == 1)
-		pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
 	omap_mcbsp_count++;
 	return 0;
 }

Signature · 2 lines

Regards,
Igor.

Jarkko Nikula

author

2011-12-12 11:22 UTC #3 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 8 lines · Igor Grinberg

Quoted 7 lines · Jarkko Nikula
Commits 09d28d ("ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src") and 7bc0c4 ("ARM: OMAP: mcbsp: Start generalize signal muxing functions") incorrectly set two struct omap_mcbsp_platform_data fields after omap_device_build_ss and kfree calls.
Fix this by moving these pdata assignments before those calls.

Quoted 10 lines

Quoted 2 lines
Signed-off-by Jarkko Nikula <[email protected]>
Reported-by neilb at suse.de
Perhaps, should be:
Reported-by NeilBrown <[email protected]>
and
Cc: <[email protected]> [3.1]
as for below.
Quoted 3 lines
---
For 3.2, 3.1 is ok.
---

No need to cc stable since the issue is not in stable kernels.

Signature · 1 line

Jarkko

Igor Grinberg

2011-12-12 11:57 UTC #4 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 18 lines · Jarkko Nikula

Hi
Quoted 15 lines · Igor Grinberg
Quoted 9 lines · Jarkko Nikula
Commits 09d28d ("ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src") and 7bc0c4 ("ARM: OMAP: mcbsp: Start generalize signal muxing functions") incorrectly set two struct omap_mcbsp_platform_data fields after omap_device_build_ss and kfree calls.
Fix this by moving these pdata assignments before those calls.
Signed-off-by Jarkko Nikula <[email protected]>
Reported-by neilb at suse.de
Perhaps, should be:
Reported-by NeilBrown <[email protected]>
and
Cc: <[email protected]> [3.1]
as for below.

Quoted 4 lines

Quoted 3 lines
Quoted 3 lines
---
For 3.2, 3.1 is ok.
---
No need to cc stable since the issue is not in stable kernels.

Ah, so I've misunderstood what was that about... So it has been introduced in 3.2-rc cycle. Ok. Then now it is the perfect time to fix this ;)

Signature · 2 lines

Regards,
Igor.

Tony Lindgren

maintainer

2011-12-12 18:33 UTC #5 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 19 lines · Igor Grinberg

Quoted 18 lines · Jarkko Nikula
Hi
Quoted 15 lines · Igor Grinberg
Quoted 9 lines · Jarkko Nikula
Commits 09d28d ("ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src") and 7bc0c4 ("ARM: OMAP: mcbsp: Start generalize signal muxing functions") incorrectly set two struct omap_mcbsp_platform_data fields after omap_device_build_ss and kfree calls.
Fix this by moving these pdata assignments before those calls.
Signed-off-by Jarkko Nikula <[email protected]>
Reported-by neilb at suse.de
Perhaps, should be:
Reported-by NeilBrown <[email protected]>
and
Cc: <[email protected]> [3.1]
as for below.

Quoted 8 lines

Quoted 4 lines
Quoted 3 lines
Quoted 3 lines
---
For 3.2, 3.1 is ok.
---
No need to cc stable since the issue is not in stable kernels.
Ah, so I've misunderstood what was that about... So it has been introduced in 3.2-rc cycle. Ok. Then now it is the perfect time to fix this ;)

Applying into fixes.

Regards,

Tony

Ramirez Luna, Omar

2011-12-14 20:50 UTC #6 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 1 line · Tony Lindgren

Applying into fixes.

FWIW, I was bisecting this issue, the patch fixes the following slab corruptions on boot log:

...
hw-breakpoint: found 5 (+1 reserved) breakpoint and 1 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 4 bytes.
Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 04 9d 02 c0 6b 6b 6b 6b 6b 6b 6b a5 ........kkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. OMAP DMA hardware revision 0.0
...

Regards,

Omar

Tony Lindgren

maintainer

2011-12-14 21:54 UTC #7 lore raw

PATCH 1/1 ARM: OMAP: mcbsp: Fix possible memory corruption

Quoted 5 lines · Ramirez Luna, Omar

Quoted 1 line · Tony Lindgren
Applying into fixes.
FWIW, I was bisecting this issue, the patch fixes the following slab corruptions on boot log:

Thanks for the info, I've sent the pull request for the two patches in fixes branch.

Regards,

Tony

Quoted 40 lines

hw-breakpoint: found 5 (+1 reserved) breakpoint and 1 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 4 bytes.
Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 04 9d 02 c0 6b 6b 6b 6b 6b 6b 6b a5 ........kkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Slab corruption: size-32 start=eea66740, len=32
010: d8 9d 02 c0 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 ....kkkkkkkkkkk. Prev obj: start=eea66720, len=32
000: 6f 6d 61 70 32 5f 6d 63 73 70 69 2e 31 00 5a 5a omap2_mcspi.1.ZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. Next obj: start=eea66760, len=32
000: 70 6f 77 65 72 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a power.ZZZZZZZZZZ 010: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a a5 ZZZZZZZZZZZZZZZ. OMAP DMA hardware revision 0.0
...
Regards,
Omar