summaryrefslogtreecommitdiff
path: root/drivers/spi/spi-fsl-espi.c
diff options
context:
space:
mode:
authorNobuteru Hayashi <hayashi.nbb@ncos.nec.co.jp>2016-03-18 11:35:21 (GMT)
committerMark Brown <broonie@kernel.org>2016-03-28 18:41:18 (GMT)
commit6319a68011b86fa61dc63e94dc4fb716628037f3 (patch)
tree2dbe35310b327e166e31cdc4f0e4752ce7889cbb /drivers/spi/spi-fsl-espi.c
parentaa70e567c4f0eeb849c6bcef3685bdf1fc3ca19d (diff)
downloadlinux-6319a68011b86fa61dc63e94dc4fb716628037f3.tar.xz
spi/fsl-espi: avoid infinite loops on fsl_espi_cpu_irq()
It brought nearly infinite loops, and was possible to be occurred only if the SPI transaction total size are not alighed with 4. Loops are here at while (tmp--), tmp is unsigned, and set it with minus value. The loops are executed as a result of unexpected RX interrupt occurrence after that. This interrupt may be hardware eratta and is not fixed. Fix mspi->len from minus value to 0 and print warning message. Signed-off-by: Nobuteru Hayashi <hayashi.nbb@ncos.nec.co.jp> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi/spi-fsl-espi.c')
-rw-r--r--drivers/spi/spi-fsl-espi.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index 64d794b..8d85a3c 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -544,6 +544,7 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
if (events & SPIE_NE) {
u32 rx_data, tmp;
u8 rx_data_8;
+ int rx_nr_bytes = 4;
int ret;
/* Spin until RX is done */
@@ -560,7 +561,14 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
if (mspi->len >= 4) {
rx_data = mpc8xxx_spi_read_reg(&reg_base->receive);
+ } else if (mspi->len <= 0) {
+ dev_err(mspi->dev,
+ "unexpected RX(SPIE_NE) interrupt occurred,\n"
+ "(local rxlen %d bytes, reg rxlen %d bytes)\n",
+ min(4, mspi->len), SPIE_RXCNT(events));
+ rx_nr_bytes = 0;
} else {
+ rx_nr_bytes = mspi->len;
tmp = mspi->len;
rx_data = 0;
while (tmp--) {
@@ -571,7 +579,7 @@ void fsl_espi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
rx_data <<= (4 - mspi->len) * 8;
}
- mspi->len -= 4;
+ mspi->len -= rx_nr_bytes;
if (mspi->rx)
mspi->get_rx(rx_data, mspi);