From patchwork Thu Nov 25 09:00:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tudor Ambarus X-Patchwork-Id: 12693612 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 87C9BC433F5 for ; Thu, 25 Nov 2021 09:04:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=0QGipSseqlCcver/r9x6xhnrFWkj2qbW75kvey7kBTU=; b=x/abe0ofXKOJfH y+vHGQBsvfsQ6CIWVzXRfWB0nyxW7zNXEwH1JzNuWs/1Xjdi8tQTZ4WVV5Oy0FudXvBnku5P8tWun dFIdoEMxDBHmfzkGKt2w63RrEoVsTMgR+FZsz7rLaAteMMgWMK5qGVPBiR8IjVLOBBR5tYq58JTF4 kSzc+pfA9KWO1d7kxJdVDWDgWXIieiuB+J7uXVSiAgUN6uxwDVLRjmQtt2JAXBp3YeOo5kHkzLAT8 54BQM+iA2QSQU+7B1pTDmfMi2A+eGz2PcMQZzKCMcJWCQN6n3WVIQ1bRrJjK1TodAK766SfkRWztF t2gzyxQvNRh1Crbu/aVA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mqAed-006oI0-CS; Thu, 25 Nov 2021 09:02:55 +0000 Received: from esa.microchip.iphmx.com ([68.232.153.233]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mqAck-006nXI-16 for linux-arm-kernel@lists.infradead.org; Thu, 25 Nov 2021 09:00:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1637830858; x=1669366858; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IzKN39oOHNC3CK9tz3WGrvZQjLqHyTGav61lvPMp9Bg=; b=Tsp90S7DtqNipbH/+p0uxNVwkwR+Xq4hAHjcLlntoV9A3d86buQuqa/5 QpvOvpwqi3RZhM69iRpI0wBnZKJiMPL/BdKVQaff4kIPTRcFkOorw4GAd tJYUvUoQXv5YjDoaCkSbsrRQcH1yVR782atLuSn+xImhl37f/VctmTlo2 0VPCCE5fgeACkMVDAznGn8YHrbKe2BqmV0KEdOgAh/qLWQmlXZu4vczMO i/XwQ0Wai6nXjYTdMk9DJppGUvtrmgFeaLlWGOzMTdObqzYcPMS2U+1U7 cWGKLWf5lbI8wLFAEr++bjFxmZc3YchfYTyoCVmc4sCo/YiQMZdE7e02I g==; IronPort-SDR: vyPr1F2plqj76Swh6q75SBov6E1446XVpQoxgAr6KVcsSSMUVDV0RqXySK++sRL7JGYf0+aGjq 2o6whjre3LV6WsdWDLsfwRGCeHz4oYPU/nnW+IB4sdckhZKALJ3Rn56yJ0NnXmf3FBm590PWUT qHO15mWufasiiOjjK6cInrkIryIu1a5M1Rsj6Q+e8qUrL1/4M6r4qWuNE3Tefoh8+QHasaaRTN 7gVzs61Djc38Op06+HUttKCmNNfjC9mmFCFUbtNpAdW4D2yxjgEdNOEal8e7AkPZ8sBu1bFLFa zIBIaiJsWx9U+3QIORpQ9cwf X-IronPort-AV: E=Sophos;i="5.87,262,1631602800"; d="scan'208";a="144534247" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa5.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 25 Nov 2021 02:00:57 -0700 Received: from chn-vm-ex02.mchp-main.com (10.10.85.144) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.14; Thu, 25 Nov 2021 02:00:56 -0700 Received: from ROB-ULT-M18064N.mchp-main.com (10.10.115.15) by chn-vm-ex02.mchp-main.com (10.10.85.144) with Microsoft SMTP Server id 15.1.2176.14 via Frontend Transport; Thu, 25 Nov 2021 02:00:53 -0700 From: Tudor Ambarus To: , , , , Subject: [PATCH v2 07/13] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Thu, 25 Nov 2021 11:00:22 +0200 Message-ID: <20211125090028.786832-8-tudor.ambarus@microchip.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211125090028.786832-1-tudor.ambarus@microchip.com> References: <20211125090028.786832-1-tudor.ambarus@microchip.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211125_010058_138536_8CEB61C5 X-CRM114-Status: GOOD ( 10.28 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: alexandre.belloni@bootlin.com, Tudor Ambarus , mripard@kernel.org, linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 4d8476845c20..2cc9af222681 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);