Commit b24823e6 authored by Alexandre Bounine's avatar Alexandre Bounine Committed by Linus Torvalds

rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler

Fix a bug that causes a kernel panic when the number of received doorbells
is larger than number of entries in the inbound doorbell queue (current
default value = 512).

Another possible indication for this bug is large number of spurious
doorbells reported by tsi721 driver after reaching the queue size maximum.
Signed-off-by: default avatarAlexandre Bounine <alexandre.bounine@idt.com>
Cc: Chul Kim <chul.kim@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>		[3.2.x+]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e6ca7b89
...@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work) ...@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
*/ */
mport = priv->mport; mport = priv->mport;
wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)); wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)); rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
while (wr_ptr != rd_ptr) { while (wr_ptr != rd_ptr) {
idb_entry = (u64 *)(priv->idb_base + idb_entry = (u64 *)(priv->idb_base +
(TSI721_IDB_ENTRY_SIZE * rd_ptr)); (TSI721_IDB_ENTRY_SIZE * rd_ptr));
rd_ptr++; rd_ptr++;
rd_ptr %= IDB_QSIZE;
idb.msg = *idb_entry; idb.msg = *idb_entry;
*idb_entry = 0; *idb_entry = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment