Re: [PATCH 4.4 101/105] spi: Fix scatterlist elements size in spi_map_buf

[Greg Kroah-Hartman]

On Fri, Jul 20, 2018 at 08:23:44PM +0100, Ben Hutchings wrote:
> On Sun, 2018-07-01 at 18:02 +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Maxime Chevallier <maxime.chevallier@xxxxxxxxxxx>
> > 
> > commit ce99319a182fe766be67f96338386f3ec73e321c upstream.
> > 
> > When SPI transfers can be offloaded using DMA, the SPI core need to
> > build a scatterlist to make sure that the buffer to be transferred is
> > dma-able.
> > 
> > This patch fixes the scatterlist entry size computation in the case
> > where the maximum acceptable scatterlist entry supported by the DMA
> > controller is less than PAGE_SIZE, when the buffer is vmalloced.
> > 
> > For each entry, the actual size is given by the minimum between the
> > desc_len (which is the max buffer size supported by the DMA controller)
> > and the remaining buffer length until we cross a page boundary.
> > 
> > Fixes: 65598c13fd66 ("spi: Fix per-page mapping of unaligned vmalloc-ed buffer")
> > Signed-off-by: Maxime Chevallier <maxime.chevallier@xxxxxxxxxxx>
> > Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@xxxxxxxxx>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >  drivers/spi/spi.c |   10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> > 
> > --- a/drivers/spi/spi.c
> > +++ b/drivers/spi/spi.c
> > @@ -707,8 +707,14 @@ static int spi_map_buf(struct spi_master
> >  	for (i = 0; i < sgs; i++) {
> >  
> >  		if (vmalloced_buf) { 
> > -			min = min_t(size_t,
> > -				    len, desc_len - offset_in_page(buf));
> > +			/*
> > +			 * Next scatterlist entry size is the minimum between
> > +			 * the desc_len and the remaining buffer length that
> > +			 * fits in a page.
> > +			 */
> > +			min = min_t(size_t, desc_len,
> > +				    min_t(size_t, len,
> > +					  PAGE_SIZE - offset_in_page(buf)));
> >  			vm_page = vmalloc_to_page(buf);
> >  			if (!vm_page) {
> >  				sg_free_table(sgt);
> 
> I think this makes sense upstream, but in 4.4 it seems to be a no-op
> since desc_len is always set to PAGE_SIZE when vmalloced_buf is true.
> This fix depends on (at least) commit df88e91bbfd1 "spi: respect the
> maximum segment size of DMA device" which went into 4.6.

Good catch.  I'll leave it as-is for now though.

thanks,

greg k-h