From patchwork Tue Nov 16 11:20:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tudor Ambarus X-Patchwork-Id: 12692744 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2AB9C433F5 for ; Tue, 16 Nov 2021 11:27:18 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 72D20619E8 for ; Tue, 16 Nov 2021 11:27:18 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 72D20619E8 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=microchip.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=0QGipSseqlCcver/r9x6xhnrFWkj2qbW75kvey7kBTU=; b=3Pp6DWS3zciKn1 q51zbfLTNROYFwuMStWSdauKR7JlkAKwz4x8XlcymKmTgx0btDRdpguxhI6aEFaGc3yknAQduHbWm ElfUX5mDyp4CxvlfEGDv8lzTrigYX8TTEU6cNT34Ly+LoufVTOZY2BTYozfUDNVUhAaiukUYbBvzF ZxOJp4xRVKQv3IyVS6t2Lsp4Ri1kD9GcyuGvdagPYl74vzNSWhJbI4+vM1rCQc0cjC6hO1zUW4Puc XbHJYn2Q0yKJafDNOcsW0ScJi8b7GJzuREtjMec9LkGw58D7MVrfteKaqGhiIccFALJ1HE0+5WomC icFW3woZ1nRW0xykcTew==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mmwan-001Pa6-By; Tue, 16 Nov 2021 11:25:38 +0000 Received: from esa.microchip.iphmx.com ([68.232.153.233]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mmwWS-001O5i-4i for linux-arm-kernel@lists.infradead.org; Tue, 16 Nov 2021 11:21:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1637061667; x=1668597667; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IzKN39oOHNC3CK9tz3WGrvZQjLqHyTGav61lvPMp9Bg=; b=i/7fHNstzAYJQFeUGwIoSFbc7giAVSCYPm4epD8LKQZ7MfwjELEOuvKK kfYarJx1TOjtueGQcf7YPe897cPMA09rAp/f5yp6KRpHOBsx8EC6HtDsi BR2CXLrAhFKt+aB0l5D65CRqlvU/3QRBVFA3ZUimYxqU3UXMmtz78rmau sU1OuPAl5IeeyBNc0vNr1/bSZV/1bAOm6YVt/VieLv51H1sqL+8gJhpw6 QhHHkJBReNqjqX8ReFa5HeLrJyw32KOX1EQ5tyr/0jyk+8nLGqfFfzFxp uzQx2PgZIKm1P6uZ0d9AU3sLWBPAdH4M/OK+CpfYUIjrVbPYo+wTn8vBt Q==; IronPort-SDR: VKKuqCuyUcNCiCN80wBHip317sB00kXuRGeonrJQnv2IFvjjiUmiX6wroEunWGJ4uQfLejH19s pWplCng62sowOwenBsynkU+bqaYzu6WaQ4WFRbhCYl5vJxY/uEfFlegEucqDzwjvOI3WmrI9fY a7mnqXY2bPV8XUZXORIM/dRHxsTXE8hHnM8O+PI9bCubO4xjD047i70seAWi+UszaQSIHqH9i0 ealXSuf88TDbd9+iOHfpcnv7ETXeeuNMFhLdift3oC1Q5BdbQ0wXTh0++aMv6+Irppym7eXOnI zgPzOHC64GPtfbdtvg4YJNni X-IronPort-AV: E=Sophos;i="5.87,239,1631602800"; d="scan'208";a="144082887" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa3.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 16 Nov 2021 04:21:07 -0700 Received: from chn-vm-ex04.mchp-main.com (10.10.85.152) by chn-vm-ex01.mchp-main.com (10.10.85.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.14; Tue, 16 Nov 2021 04:21:07 -0700 Received: from ROB-ULT-M18064N.mchp-main.com (10.10.115.15) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server id 15.1.2176.14 via Frontend Transport; Tue, 16 Nov 2021 04:21:04 -0700 From: Tudor Ambarus To: , , , , Subject: [PATCH 07/13] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Tue, 16 Nov 2021 13:20:30 +0200 Message-ID: <20211116112036.96349-8-tudor.ambarus@microchip.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211116112036.96349-1-tudor.ambarus@microchip.com> References: <20211116112036.96349-1-tudor.ambarus@microchip.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211116_032108_269486_A17BF301 X-CRM114-Status: UNSURE ( 9.61 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: alexandre.belloni@bootlin.com, Tudor Ambarus , mripard@kernel.org, linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 4d8476845c20..2cc9af222681 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);