This is a note to let you know that I've just added the patch titled
rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler
to the 3.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rapidio-tsi721-fix-queue-wrapping-bug-in-inbound-doorbell-handler.patch
and it can be found in the queue-3.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From b24823e61bfd93d0e72088e4f5245287582ed289 Mon Sep 17 00:00:00 2001
From: Alexandre Bounine <[email protected]>
Date: Mon, 5 Mar 2012 14:59:21 -0800
Subject: rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler
From: Alexandre Bounine <[email protected]>
commit b24823e61bfd93d0e72088e4f5245287582ed289 upstream.
Fix a bug that causes a kernel panic when the number of received doorbells
is larger than number of entries in the inbound doorbell queue (current
default value = 512).
Another possible indication for this bug is large number of spurious
doorbells reported by tsi721 driver after reaching the queue size maximum.
Signed-off-by: Alexandre Bounine <[email protected]>
Cc: Chul Kim <[email protected]>
Cc: Matt Porter <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/rapidio/devices/tsi721.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_st
*/
mport = priv->mport;
- wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
- rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+ wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+ rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
while (wr_ptr != rd_ptr) {
idb_entry = (u64 *)(priv->idb_base +
(TSI721_IDB_ENTRY_SIZE * rd_ptr));
rd_ptr++;
+ rd_ptr %= IDB_QSIZE;
idb.msg = *idb_entry;
*idb_entry = 0;
Patches currently in stable-queue which might be from [email protected]
are
queue-3.2/rapidio-tsi721-fix-queue-wrapping-bug-in-inbound-doorbell-handler.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
