ARM: 7242/1: PL330: Detach the request from the pl330_thread when it finishes successful

When a request has finished successfully and we are about to call its
callback, remove its pointer from the corresponding pl330_thread .
This prevents the core driver from calling its callback again if
pl330_release_channel() is called without first flushing the device.
When pl330_update() returns, the driver is allowed to free the pointer
to pl330_req so the core driver shouldn't be able to access it again.

Reference: <CAJe_ZhftO+481BfL0ErEcM_brfmSuTXkTEniLRYxxM2T7OM2QA@mail.gmail.com>

Signed-off-by: Javi Merino <javi.merino@arm.com>
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

1 files changed, 7 insertions, 1 deletions

diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index 8d8df744f7a5..d8e44a43047c 100644
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -1467,13 +1467,19 @@ int pl330_update(const struct pl330_info *pi)
 
         /* Now that we are in no hurry, do the callbacks */
         while (!list_empty(&pl330->req_done)) {
+                struct pl330_req *r;
+
                 rqdone = container_of(pl330->req_done.next,
                                         struct _pl330_req, rqd);
 
                 list_del_init(&rqdone->rqd);
 
+                /* Detach the req */
+                r = rqdone->r;
+                rqdone->r = NULL;
+
                 spin_unlock_irqrestore(&pl330->lock, flags);
-                _callback(rqdone->r, PL330_ERR_NONE);
+                _callback(r, PL330_ERR_NONE);
                 spin_lock_irqsave(&pl330->lock, flags);
         }