From patchwork Wed Dec 15 11:01:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tudor Ambarus X-Patchwork-Id: 12696254 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E8250C433EF for ; Wed, 15 Dec 2021 11:09:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=gv/U0tD71wIp+VD0+Os1Gk4wtC6xSnufgn8p49Qk+CI=; b=rTwg7OfxW4Y9Ws FQI0AOdYvWQRvMwrQwgME3trNf4zwTWRj1LwWsds1o8K4Y8pX349a0OrOdA6IqcbddVh7dGxMqQkx +DffnyRep5ALu0syVRBatSMetICq1VZ9pmJsx9UFkPxigek92FM4T8HTW38eoa5q/CcBQFegrcczf yQT+G3qsRGKnr+ChLgxBs2Dtw7BsQF7oP69QyzpDgVbytN9hB3N353kR0d8XHR6PJryyRXPhc0Ueb cUxPkUvVMXMyR5HEpSDtj3BjW+MoW/5w6chJ24HkDvqf1dyuzZykYX10wsJyMSqkKNhGiAqzYdw5p GztLloe7IQ6Q28aCUqgA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mxS8L-000PP0-Pn; Wed, 15 Dec 2021 11:07:42 +0000 Received: from esa.microchip.iphmx.com ([68.232.154.123]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mxS2Q-000MFN-2E for linux-arm-kernel@lists.infradead.org; Wed, 15 Dec 2021 11:01:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1639566093; x=1671102093; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4X8BJvNzEUcQqoMWQpov9DWaBKuYhadvuaqzWzFzBHw=; b=Yna+Pnop/z9nBVz00MwEulQ0mMNeFx+JQz22Xk/1p+CLhrtYy/Mbh+Rs gShDzj/Tt1KZsLspZIecA+9T7ondMwYMjO+E4qAaV8FdHeNXw3Vfh7p8q 9RJ4tHQxvmMLgVSPlYUEmYaeo7X4LnL/dv9NNCUy4BOOo1VCgoz+II8U0 aMoPLOcIJRdIPQReUyJv2aq47MUI8DE3eA3KzKSW0kxM2/t6ry8IZIOs1 Cgy3gh2xuN84J6SIEj/9TKarQtkTH5bJMVKFt/tQMQYD4MFAZk22ngidh kIqV0bQVc0fOVsIURxcPvsyZnSvSvksqOvRx0lEYi0cJ3ttyloEDnwniw Q==; IronPort-SDR: 5144dnubbSn42QemwMCTwZaOM6kP58KT4tTkUJEtFCZkYQpFbIhDXDKuLbymvtzEgIDnn8+CFk uBAg6Psn3qTRey/XPwckMnhzBEoPaGwD+Vxo9WcTmcTDuwuga1pgYLV4JoSUKKM7RTDpAzpf7Z wvq6FYpnSlvarZkqcLCttwPB7Bxbob44IfF027f09Hy3X2uaFskVUk+Y69To2eVQpLIAEzEzpY 2ze8Qp2ltApX5tQ+9iLfRxKgHLtqMQCosvb0W3TotrTysiDv7ewiJDSpVzC9vGQV17zAFe+Lj3 Xa3ipGFZ0gXjekR9tfAhEhuF X-IronPort-AV: E=Sophos;i="5.88,207,1635231600"; d="scan'208";a="139842688" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa4.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 15 Dec 2021 04:01:33 -0700 Received: from chn-vm-ex03.mchp-main.com (10.10.85.151) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.17; Wed, 15 Dec 2021 04:01:32 -0700 Received: from ROB-ULT-M18064N.mchp-main.com (10.10.115.15) by chn-vm-ex03.mchp-main.com (10.10.85.151) with Microsoft SMTP Server id 15.1.2375.17 via Frontend Transport; Wed, 15 Dec 2021 04:01:30 -0700 From: Tudor Ambarus To: Subject: [PATCH v3 05/12] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Wed, 15 Dec 2021 13:01:08 +0200 Message-ID: <20211215110115.191749-6-tudor.ambarus@microchip.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211215110115.191749-1-tudor.ambarus@microchip.com> References: <20211215110115.191749-1-tudor.ambarus@microchip.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211215_030134_263501_8DA7F830 X-CRM114-Status: GOOD ( 10.39 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Tudor Ambarus , mripard@kernel.org, linux-kernel@vger.kernel.org, ludovic.desroches@microchip.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fix the race for the tx desc callback by moving the xfer desc into the free desc list after the callback is invoked. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 83c031207530..d5b37459f906 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);