[PATCH AUTOSEL for 3.18 033/101] i2c: ismt: fix wrong device address when unmap the data buffer
From: Liwei Song[ Upstream commit 17e83549e199d89aace7788a9f11c108671eecf5 ] Fix the following kernel bug: kernel BUG at drivers/iommu/intel-iommu.c:3260! invalid opcode: [#5] PREEMPT SMP Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016 task: 880175389950 ti: 880176bec000 task.ti: 880176bec000 RIP: 0010:[] [] intel_unmap+0x25b/0x260 RSP: 0018:880176bef5e8 EFLAGS: 00010296 RAX: 0024 RBX: 8800773c7c88 RCX: ce04 RDX: 8000 RSI: RDI: 0009 RBP: 880176bef638 R08: 0010 R09: 0004 R10: 880175389c78 R11: 0a4f R12: 8800773c7868 R13: ac88 R14: 8800773c7818 R15: 0001 FS: 7fef21258700() GS:88017b5c() knlGS: CS: 0010 DS: ES: CR0: 80050033 CR2: 0066d6d8 CR3: 7118c000 CR4: 003406e0 Stack: ac88 8199867f 880176bef5f8 88010030 880176bef668 8800773c7c88 880178288098 8800772c0010 8800773c7818 0001 880176bef648 8150a86e Call Trace: [] ? printk+0x46/0x48 [] intel_unmap_page+0xe/0x10 [] ismt_access+0x27b/0x8fa [i2c_ismt] [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? pci_bus_read_dev_vendor_id+0xf0/0xf0 [] i2c_smbus_xfer+0xec/0x4b0 [] ? vprintk_emit+0x345/0x530 [] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev] [] ? vprintk_default+0x29/0x40 [] i2cdev_ioctl+0x63/0x1ec [i2c_dev] [] do_vfs_ioctl+0x328/0x5d0 [] ? vfs_write+0x11c/0x190 [] ? rt_up_read+0x19/0x20 [] SyS_ioctl+0x81/0xa0 [] system_call_fastpath+0x16/0x6e This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter. After finished I2C block read/write, when unmap the data buffer, a wrong device address was pass to dma_unmap_single(). To fix this, give dma_unmap_single() the "dev" parameter, just like what dma_map_single() does, then unmap can find the right devices. Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller") Signed-off-by: Liwei Song Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-ismt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c index f771c6afbab5..beab499d182c 100644 --- a/drivers/i2c/busses/i2c-ismt.c +++ b/drivers/i2c/busses/i2c-ismt.c @@ -587,7 +587,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, /* unmap the data buffer */ if (dma_size != 0) - dma_unmap_single(>dev, dma_addr, dma_size, dma_direction); + dma_unmap_single(dev, dma_addr, dma_size, dma_direction); if (unlikely(!ret)) { dev_err(dev, "completion wait timed out\n"); -- 2.15.1
[PATCH AUTOSEL for 3.18 033/101] i2c: ismt: fix wrong device address when unmap the data buffer
From: Liwei Song [ Upstream commit 17e83549e199d89aace7788a9f11c108671eecf5 ] Fix the following kernel bug: kernel BUG at drivers/iommu/intel-iommu.c:3260! invalid opcode: [#5] PREEMPT SMP Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016 task: 880175389950 ti: 880176bec000 task.ti: 880176bec000 RIP: 0010:[] [] intel_unmap+0x25b/0x260 RSP: 0018:880176bef5e8 EFLAGS: 00010296 RAX: 0024 RBX: 8800773c7c88 RCX: ce04 RDX: 8000 RSI: RDI: 0009 RBP: 880176bef638 R08: 0010 R09: 0004 R10: 880175389c78 R11: 0a4f R12: 8800773c7868 R13: ac88 R14: 8800773c7818 R15: 0001 FS: 7fef21258700() GS:88017b5c() knlGS: CS: 0010 DS: ES: CR0: 80050033 CR2: 0066d6d8 CR3: 7118c000 CR4: 003406e0 Stack: ac88 8199867f 880176bef5f8 88010030 880176bef668 8800773c7c88 880178288098 8800772c0010 8800773c7818 0001 880176bef648 8150a86e Call Trace: [] ? printk+0x46/0x48 [] intel_unmap_page+0xe/0x10 [] ismt_access+0x27b/0x8fa [i2c_ismt] [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? pci_bus_read_dev_vendor_id+0xf0/0xf0 [] i2c_smbus_xfer+0xec/0x4b0 [] ? vprintk_emit+0x345/0x530 [] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev] [] ? vprintk_default+0x29/0x40 [] i2cdev_ioctl+0x63/0x1ec [i2c_dev] [] do_vfs_ioctl+0x328/0x5d0 [] ? vfs_write+0x11c/0x190 [] ? rt_up_read+0x19/0x20 [] SyS_ioctl+0x81/0xa0 [] system_call_fastpath+0x16/0x6e This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter. After finished I2C block read/write, when unmap the data buffer, a wrong device address was pass to dma_unmap_single(). To fix this, give dma_unmap_single() the "dev" parameter, just like what dma_map_single() does, then unmap can find the right devices. Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller") Signed-off-by: Liwei Song Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-ismt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c index f771c6afbab5..beab499d182c 100644 --- a/drivers/i2c/busses/i2c-ismt.c +++ b/drivers/i2c/busses/i2c-ismt.c @@ -587,7 +587,7 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, /* unmap the data buffer */ if (dma_size != 0) - dma_unmap_single(>dev, dma_addr, dma_size, dma_direction); + dma_unmap_single(dev, dma_addr, dma_size, dma_direction); if (unlikely(!ret)) { dev_err(dev, "completion wait timed out\n"); -- 2.15.1