From patchwork Thu Oct 1 07:22:17 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 7305681 Return-Path: X-Original-To: patchwork-dmaengine@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 18D5FBF90C for ; Thu, 1 Oct 2015 07:22:23 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 39692207F0 for ; Thu, 1 Oct 2015 07:22:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3AD9320803 for ; Thu, 1 Oct 2015 07:22:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756057AbbJAHWQ (ORCPT ); Thu, 1 Oct 2015 03:22:16 -0400 Received: from andre.telenet-ops.be ([195.130.132.53]:49661 "EHLO andre.telenet-ops.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756025AbbJAHWP (ORCPT ); Thu, 1 Oct 2015 03:22:15 -0400 Received: from ayla.of.borg ([84.195.106.123]) by andre.telenet-ops.be with bizsmtp id PjNA1r01R2fm56U01jNAEd; Thu, 01 Oct 2015 09:22:13 +0200 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.82) (envelope-from ) id 1ZhYBu-00013Y-KJ; Thu, 01 Oct 2015 09:22:10 +0200 Received: from geert by ramsan with local (Exim 4.82) (envelope-from ) id 1ZhYC4-0008Ox-6G; Thu, 01 Oct 2015 09:22:20 +0200 From: Geert Uytterhoeven To: Vinod Koul , Yoshihiro Shimoda Cc: Sergei Shtylyov , dmaengine@vger.kernel.org, linux-sh@vger.kernel.org, linux-pm@vger.kernel.org, Geert Uytterhoeven Subject: [PATCH 1/2] dmaengine: usb-dmac: Fix crash on runtime suspend Date: Thu, 1 Oct 2015 09:22:17 +0200 Message-Id: <1443684138-32252-2-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1443684138-32252-1-git-send-email-geert+renesas@glider.be> References: <1443684138-32252-1-git-send-email-geert+renesas@glider.be> Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If CONFIG_PREEMPT=y: Unable to handle kernel NULL pointer dereference at virtual address 00000014 pgd = c0003000 [00000014] *pgd=80000040004003, *pmd=00000000 Internal error: Oops: 206 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 17 Comm: kworker/0:1 Tainted: G W 4.3.0-rc3-koelsch-022 71-g705498fc5e6a5da8-dirty #1789 Hardware name: Generic R8A7791 (Flattened Device Tree) Workqueue: pm pm_runtime_work task: ef578e40 ti: ef57a000 task.ti: ef57a000 PC is at usb_dmac_chan_halt+0xc/0xc0 LR is at usb_dmac_runtime_suspend+0x28/0x38 pc : [] lr : [] psr: 80000113 sp : ef57bdf8 ip : 00000008 fp : 00000003 r10: 00000008 r9 : c06ab928 r8 : ef49e810 r7 : 00000000 r6 : 000000ac r5 : ef770010 r4 : 00000000 r3 : 00000000 r2 : 8ffc2b84 r1 : 00000000 r0 : ef770010 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 30c5307d Table: 40003000 DAC: fffffffd Process kworker/0:1 (pid: 17, stack limit = 0xef57a210) Stack: (0xef57bdf8 to 0xef57c000) [... [] (usb_dmac_chan_halt) from [] (usb_dmac_runtime_suspend+0x28/0x38) [] (usb_dmac_runtime_suspend) from [] (pm_genpd_runtime_suspend+0x74/0x23c) This happens because usb_dmac_probe() calls pm_runtime_put() before usb_dmac_chan_probe(), leading to the device being suspended before the DMA channels are initialized, causing a NULL pointer dereference. Move the call to pm_runtime_put() to the end of usb_dmac_probe() to fix this. Add a check to usb_dmac_runtime_suspend() to prevent the crash from happening in the error path. Reported-by: Sergei Shtylyov Signed-off-by: Geert Uytterhoeven Tested-by: Yoshihiro Shimoda --- drivers/dma/sh/usb-dmac.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c index ebd8a5f398b08ee2..f305738b5adf8cc9 100644 --- a/drivers/dma/sh/usb-dmac.c +++ b/drivers/dma/sh/usb-dmac.c @@ -679,8 +679,11 @@ static int usb_dmac_runtime_suspend(struct device *dev) struct usb_dmac *dmac = dev_get_drvdata(dev); int i; - for (i = 0; i < dmac->n_channels; ++i) + for (i = 0; i < dmac->n_channels; ++i) { + if (!dmac->channels[i].iomem) + break; usb_dmac_chan_halt(&dmac->channels[i]); + } return 0; } @@ -803,7 +806,6 @@ static int usb_dmac_probe(struct platform_device *pdev) } ret = usb_dmac_init(dmac); - pm_runtime_put(&pdev->dev); if (ret) { dev_err(&pdev->dev, "failed to reset device\n"); @@ -851,10 +853,12 @@ static int usb_dmac_probe(struct platform_device *pdev) if (ret < 0) goto error; + pm_runtime_put(&pdev->dev); return 0; error: of_dma_controller_free(pdev->dev.of_node); + pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); return ret; }