aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorIago Abal <mail@iagoabal.eu>2016-06-03 05:21:25 -0400
committerSebastian Reichel <sre@kernel.org>2016-06-09 18:08:10 -0400
commit3c13ab1d96e1924ef73b1a20c1ccccc993b6fb58 (patch)
tree1ea69031639199f84e609e1c6f59791beb0c5fdf
parentb32bd7e7d5c1c04bb351420c09217f38dad8b8f1 (diff)
HSI: cmt_speech: Fix double spin_lock
Release &hi->lock before calling `cs_hsi_control_read_error' to avoid deadlock. The bug was found using EBA (https://github.com/models-team/eba), which reported the following: Double lock first at drivers/hsi/clients/cmt_speech.c:443 second at drivers/hsi/clients/cmt_speech.c:447 In cs_hsi_read_on_control_complete defined at drivers/hsi/clients/cmt_speech.c:438: (!) drivers/hsi/clients/cmt_speech.c:443: spin_lock(& hi->lock); (?) drivers/hsi/clients/cmt_speech.c:445: msg->status == 4 -> true (!) drivers/hsi/clients/cmt_speech.c:447: cs_hsi_control_read_error(hi, msg); (!) drivers/hsi/clients/cmt_speech.c:407: __cs_hsi_error_pre(hi, msg, "control read", & hi->control_state); (!) drivers/hsi/clients/cmt_speech.c:382: spin_lock(& hi->lock); Signed-off-by: Iago Abal <mail@iagoabal.eu> Signed-off-by: Sebastian Reichel <sre@kernel.org>
-rw-r--r--drivers/hsi/clients/cmt_speech.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/hsi/clients/cmt_speech.c b/drivers/hsi/clients/cmt_speech.c
index b16cfa4b2360..3deef6cc7d7c 100644
--- a/drivers/hsi/clients/cmt_speech.c
+++ b/drivers/hsi/clients/cmt_speech.c
@@ -444,8 +444,8 @@ static void cs_hsi_read_on_control_complete(struct hsi_msg *msg)
444 hi->control_state &= ~SSI_CHANNEL_STATE_READING; 444 hi->control_state &= ~SSI_CHANNEL_STATE_READING;
445 if (msg->status == HSI_STATUS_ERROR) { 445 if (msg->status == HSI_STATUS_ERROR) {
446 dev_err(&hi->cl->device, "Control RX error detected\n"); 446 dev_err(&hi->cl->device, "Control RX error detected\n");
447 cs_hsi_control_read_error(hi, msg);
448 spin_unlock(&hi->lock); 447 spin_unlock(&hi->lock);
448 cs_hsi_control_read_error(hi, msg);
449 goto out; 449 goto out;
450 } 450 }
451 dev_dbg(&hi->cl->device, "Read on control: %08X\n", cmd); 451 dev_dbg(&hi->cl->device, "Read on control: %08X\n", cmd);