[PATCH 4.9 034/105] mailbox: skip complete wait event if timer expired

From: Greg Kroah-Hartman
Date: Fri Aug 04 2017 - 20:13:15 EST

4.9-stable review patch. If anyone has any objections, please let me know.


From: Sudeep Holla <sudeep.holla@xxxxxxx>

commit cc6eeaa3029a6dbcb4ad41b1f92876483bd88965 upstream.

If a wait_for_completion_timeout() call returns due to a timeout,
complete() can get called after returning from the wait which is
incorrect and can cause subsequent transmissions on a channel to fail.
Since the wait_for_completion_timeout() sees the completion variable
is non-zero caused by the erroneous/spurious complete() call, and
it immediately returns without waiting for the time as expected by the

This patch fixes the issue by skipping complete() call for the timer

Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox")
Reported-by: Alexey Klimov <alexey.klimov@xxxxxxx>
Signed-off-by: Sudeep Holla <sudeep.holla@xxxxxxx>
Signed-off-by: Jassi Brar <jaswinder.singh@xxxxxxxxxx>
Signed-off-by: Amit Pundir <amit.pundir@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

drivers/mailbox/mailbox.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/mailbox/mailbox.c
+++ b/drivers/mailbox/mailbox.c
@@ -108,7 +108,7 @@ static void tx_tick(struct mbox_chan *ch
if (mssg && chan->cl->tx_done)
chan->cl->tx_done(chan->cl, mssg, r);

- if (chan->cl->tx_block)
+ if (r != -ETIME && chan->cl->tx_block)

@@ -272,8 +272,8 @@ int mbox_send_message(struct mbox_chan *

ret = wait_for_completion_timeout(&chan->tx_complete, wait);
if (ret == 0) {
- t = -EIO;
- tx_tick(chan, -EIO);
+ t = -ETIME;
+ tx_tick(chan, t);