From: Alexandre Bounine <[email protected]> Subject: rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler
Fix a bug that causes a kernel panic when the number of received doorbells is larger than number of entries in the inbound doorbell queue (current default value = 512). Another possible indication for this bug is large number of spurious doorbells reported by tsi721 driver after reaching the queue size maximum. Signed-off-by: Alexandre Bounine <[email protected]> Cc: Chul Kim <[email protected]> Cc: Matt Porter <[email protected]> Cc: <[email protected]> [3.2.x+] Signed-off-by: Andrew Morton <[email protected]> --- drivers/rapidio/devices/tsi721.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff -puN drivers/rapidio/devices/tsi721.c~rapidio-tsi721-fix-bug-in-inbound-doorbell-handler drivers/rapidio/devices/tsi721.c --- a/drivers/rapidio/devices/tsi721.c~rapidio-tsi721-fix-bug-in-inbound-doorbell-handler +++ a/drivers/rapidio/devices/tsi721.c @@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_st */ mport = priv->mport; - wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)); - rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)); + wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE; + rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE; while (wr_ptr != rd_ptr) { idb_entry = (u64 *)(priv->idb_base + (TSI721_IDB_ENTRY_SIZE * rd_ptr)); rd_ptr++; + rd_ptr %= IDB_QSIZE; idb.msg = *idb_entry; *idb_entry = 0; _ -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
