From patchwork Tue Nov 16 11:20:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tudor Ambarus X-Patchwork-Id: 12622033 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F817C4167D for ; Tue, 16 Nov 2021 11:21:56 +0000 (UTC) Received: from vger.kernel.org (unknown [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2D8B761055 for ; Tue, 16 Nov 2021 11:21:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 2D8B761055 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=microchip.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234980AbhKPLYe (ORCPT ); Tue, 16 Nov 2021 06:24:34 -0500 Received: from esa.microchip.iphmx.com ([68.232.153.233]:8953 "EHLO esa.microchip.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234930AbhKPLYE (ORCPT ); Tue, 16 Nov 2021 06:24:04 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=microchip.com; i=@microchip.com; q=dns/txt; s=mchp; t=1637061667; x=1668597667; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IzKN39oOHNC3CK9tz3WGrvZQjLqHyTGav61lvPMp9Bg=; b=i/7fHNstzAYJQFeUGwIoSFbc7giAVSCYPm4epD8LKQZ7MfwjELEOuvKK kfYarJx1TOjtueGQcf7YPe897cPMA09rAp/f5yp6KRpHOBsx8EC6HtDsi BR2CXLrAhFKt+aB0l5D65CRqlvU/3QRBVFA3ZUimYxqU3UXMmtz78rmau sU1OuPAl5IeeyBNc0vNr1/bSZV/1bAOm6YVt/VieLv51H1sqL+8gJhpw6 QhHHkJBReNqjqX8ReFa5HeLrJyw32KOX1EQ5tyr/0jyk+8nLGqfFfzFxp uzQx2PgZIKm1P6uZ0d9AU3sLWBPAdH4M/OK+CpfYUIjrVbPYo+wTn8vBt Q==; IronPort-SDR: VKKuqCuyUcNCiCN80wBHip317sB00kXuRGeonrJQnv2IFvjjiUmiX6wroEunWGJ4uQfLejH19s pWplCng62sowOwenBsynkU+bqaYzu6WaQ4WFRbhCYl5vJxY/uEfFlegEucqDzwjvOI3WmrI9fY a7mnqXY2bPV8XUZXORIM/dRHxsTXE8hHnM8O+PI9bCubO4xjD047i70seAWi+UszaQSIHqH9i0 ealXSuf88TDbd9+iOHfpcnv7ETXeeuNMFhLdift3oC1Q5BdbQ0wXTh0++aMv6+Irppym7eXOnI zgPzOHC64GPtfbdtvg4YJNni X-IronPort-AV: E=Sophos;i="5.87,239,1631602800"; d="scan'208";a="144082887" Received: from smtpout.microchip.com (HELO email.microchip.com) ([198.175.253.82]) by esa3.microchip.iphmx.com with ESMTP/TLS/AES256-SHA256; 16 Nov 2021 04:21:07 -0700 Received: from chn-vm-ex04.mchp-main.com (10.10.85.152) by chn-vm-ex01.mchp-main.com (10.10.85.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.14; Tue, 16 Nov 2021 04:21:07 -0700 Received: from ROB-ULT-M18064N.mchp-main.com (10.10.115.15) by chn-vm-ex04.mchp-main.com (10.10.85.152) with Microsoft SMTP Server id 15.1.2176.14 via Frontend Transport; Tue, 16 Nov 2021 04:21:04 -0700 From: Tudor Ambarus To: , , , , CC: , , , , , , , Tudor Ambarus Subject: [PATCH 07/13] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Tue, 16 Nov 2021 13:20:30 +0200 Message-ID: <20211116112036.96349-8-tudor.ambarus@microchip.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211116112036.96349-1-tudor.ambarus@microchip.com> References: <20211116112036.96349-1-tudor.ambarus@microchip.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 4d8476845c20..2cc9af222681 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status);