ARM: 7242/1: PL330: Detach the request from the pl330_thread when it finishes successful

When a request has finished successfully and we are about to call its
callback, remove its pointer from the corresponding pl330_thread .
This prevents the core driver from calling its callback again if
pl330_release_channel() is called without first flushing the device.
When pl330_update() returns, the driver is allowed to free the pointer
to pl330_req so the core driver shouldn't be able to access it again.

Reference: <CAJe_ZhftO+481BfL0ErEcM_brfmSuTXkTEniLRYxxM2T7OM2QA@mail.gmail.com>

Signed-off-by: Javi Merino <javi.merino@arm.com>
Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index 8d8df744f7a5eb72e02bc65bf85029c2b9f60a63..d8e44a43047ce5cce3a2db34b9368eafe157f579 100644 (file)
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -1467,13 +1467,19 @@ int pl330_update(const struct pl330_info *pi)
 
        /* Now that we are in no hurry, do the callbacks */
        while (!list_empty(&pl330->req_done)) {
+               struct pl330_req *r;
+
                rqdone = container_of(pl330->req_done.next,
                                        struct _pl330_req, rqd);
 
                list_del_init(&rqdone->rqd);
 
+               /* Detach the req */
+               r = rqdone->r;
+               rqdone->r = NULL;
+
                spin_unlock_irqrestore(&pl330->lock, flags);
-               _callback(rqdone->r, PL330_ERR_NONE);
+               _callback(r, PL330_ERR_NONE);
                spin_lock_irqsave(&pl330->lock, flags);
        }