From: "Rafał Hibner" <rafal.hibner@secom.com.pl>
To: unlisted-recipients:; (no To-header on input)
Cc: "Rafał Hibner" <rafal.hibner@secom.com.pl>,
"Appana Durga Kedareswara rao" <appana.durga.rao@xilinx.com>,
"Radhey Shyam Pandey" <radhey.shyam.pandey@xilinx.com>,
"Harini Katakam" <harini.katakam@xilinx.com>,
"Vinod Koul" <vkoul@kernel.org>,
"Dan Williams" <dan.j.williams@intel.com>,
"Michal Simek" <michal.simek@xilinx.com>,
dmaengine@vger.kernel.org (open list:DMA GENERIC OFFLOAD ENGINE
SUBSYSTEM),
linux-arm-kernel@lists.infradead.org (moderated list:ARM/ZYNQ
ARCHITECTURE), linux-kernel@vger.kernel.org (open list)
Subject: [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing during reset
Date: Tue, 28 Apr 2020 16:32:26 +0200 [thread overview]
Message-ID: <20200428143225.3357-1-rafal.hibner@secom.com.pl> (raw)
List elements are not formally removed from list therefore
list head is not initialized during zynqmp_dma_reset.
Signed-off-by: Rafal Hibner <rafal.hibner@secom.com.pl>
This BUG causes kernel panic when transaction is unsuccessful:
------------[ cut here ]------------
[ 62.710730] list_add corruption. prev->next should be next (ffffffc07d308040), but was dead000000000100. (prev=ffffffc0540b40b8).
[ 62.727960] WARNING: CPU: 0 PID: 1845 at /home/rafalh11/zynq_proj/zynq_platform/KERNEL/linux-xlnx/lib/list_debug.c:28 __list_add_valid+0x74/0xa0
[ 62.746374] Modules linked in: secom_mx_rpmsg(O) rpmsg_char secom_mx_retune(O) ad9680(O) ad5686_spi(O) ad5686(O) ad7298(O) ltc5594(O) lmx2594(O) ad8366(O) secom_mx(O) axi_jesd204_rx(O) axi_adxcvr(O) xilinx_transceiver(O) cf_axi_adc_core(O) hmc7044(O)
[ 62.768546] CPU: 0 PID: 1845 Comm: mx Tainted: G O 4.19.0 #10
[ 62.775582] Hardware name: xlnx,zynqmp (DT)
[ 62.779750] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 62.784524] pc : __list_add_valid+0x74/0xa0
[ 62.788690] lr : __list_add_valid+0x74/0xa0
[ 62.792855] sp : ffffff8008003da0
[ 62.796154] x29: ffffff8008003da0 x28: 0000000000000020
[ 62.801457] x27: 0000000000000000 x26: dead000000000100
[ 62.806760] x25: ffffffc07d308040 x24: ffffffc0540b40a0
[ 62.812064] x23: ffffffc07d308018 x22: 0000000000000000
[ 62.817359] x21: ffffffc07d308018 x20: ffffffc0540b40b8
[ 62.822654] x19: ffffffc0540b40b8 x18: ffffffffffffffff
[ 62.827957] x17: 0000000000000000 x16: 0000000000000000
[ 62.833252] x15: ffffff8008f88648 x14: 3034303830336437
[ 62.838546] x13: ffffff8008f88670 x12: ffffff80085d0ec0
[ 62.843841] x11: ffffff8008f65018 x10: 0000000000000006
[ 62.849136] x9 : 657270202e6e6f69 x8 : 3462303435306366
[ 62.854431] x7 : 66666666663d7665 x6 : 00000000000001a2
[ 62.859726] x5 : 0000000000000064 x4 : 0000000000000000
[ 62.865020] x3 : 0000000000000000 x2 : ffffffffffffffff
[ 62.870315] x1 : 0cbee765ba0ec900 x0 : 0000000000000000
[ 62.875611] Call trace:
[ 62.878042] __list_add_valid+0x74/0xa0
[ 62.881864] zynqmp_dma_free_descriptor+0x48/0x100
[ 62.886644] zynqmp_dma_chan_desc_cleanup+0xb4/0xf8
[ 62.891505] zynqmp_dma_do_tasklet+0x68/0x110
[ 62.895847] tasklet_action_common.isra.3+0x7c/0x168
[ 62.900801] tasklet_action+0x24/0x30
[ 62.904447] __do_softirq+0x10c/0x200
[ 62.908092] irq_exit+0xac/0xc0
[ 62.911219] __handle_domain_irq+0x60/0xb0
[ 62.915305] gic_handle_irq+0x64/0xc0
[ 62.918951] el1_irq+0xb0/0x140
[ 62.922078] schedule_timeout+0x218/0x3a0
[ 62.926077] wait_for_common+0x170/0x268
[ 62.929983] wait_for_completion_timeout+0x10/0x18
[ 62.934761] ioctl+0x64/0x270 [secom_mx_retune]
[ 62.939281] do_vfs_ioctl+0xb8/0x900
[ 62.942838] ksys_ioctl+0x44/0x90
[ 62.946137] __arm64_sys_ioctl+0x1c/0x28
[ 62.950044] el0_svc_common+0x60/0xe8
[ 62.953689] el0_svc_handler+0x6c/0x88
[ 62.957421] el0_svc+0x8/0xc
[ 62.960284] ---[ end trace 91b4fdfe685446c4 ]---
[ 62.964934] ------------[ cut here ]------------
---
drivers/dma/xilinx/zynqmp_dma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 931e41a72..a2b0be07e 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -453,6 +453,7 @@ static void zynqmp_dma_free_desc_list(struct zynqmp_dma_chan *chan,
list_for_each_entry_safe(desc, next, list, node)
zynqmp_dma_free_descriptor(chan, desc);
+ INIT_LIST_HEAD(list);
}
/**
--
2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: "Rafał Hibner" <rafal.hibner@secom.com.pl>
Cc: "Rafał Hibner" <rafal.hibner@secom.com.pl>,
"Radhey Shyam Pandey" <radhey.shyam.pandey@xilinx.com>,
"Michal Simek" <michal.simek@xilinx.com>,
"open list" <linux-kernel@vger.kernel.org>,
"Vinod Koul" <vkoul@kernel.org>,
"Appana Durga Kedareswara rao" <appana.durga.rao@xilinx.com>,
"open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM"
<dmaengine@vger.kernel.org>,
"Harini Katakam" <harini.katakam@xilinx.com>,
"Dan Williams" <dan.j.williams@intel.com>,
"moderated list:ARM/ZYNQ ARCHITECTURE"
<linux-arm-kernel@lists.infradead.org>
Subject: [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing during reset
Date: Tue, 28 Apr 2020 16:32:26 +0200 [thread overview]
Message-ID: <20200428143225.3357-1-rafal.hibner@secom.com.pl> (raw)
List elements are not formally removed from list therefore
list head is not initialized during zynqmp_dma_reset.
Signed-off-by: Rafal Hibner <rafal.hibner@secom.com.pl>
This BUG causes kernel panic when transaction is unsuccessful:
------------[ cut here ]------------
[ 62.710730] list_add corruption. prev->next should be next (ffffffc07d308040), but was dead000000000100. (prev=ffffffc0540b40b8).
[ 62.727960] WARNING: CPU: 0 PID: 1845 at /home/rafalh11/zynq_proj/zynq_platform/KERNEL/linux-xlnx/lib/list_debug.c:28 __list_add_valid+0x74/0xa0
[ 62.746374] Modules linked in: secom_mx_rpmsg(O) rpmsg_char secom_mx_retune(O) ad9680(O) ad5686_spi(O) ad5686(O) ad7298(O) ltc5594(O) lmx2594(O) ad8366(O) secom_mx(O) axi_jesd204_rx(O) axi_adxcvr(O) xilinx_transceiver(O) cf_axi_adc_core(O) hmc7044(O)
[ 62.768546] CPU: 0 PID: 1845 Comm: mx Tainted: G O 4.19.0 #10
[ 62.775582] Hardware name: xlnx,zynqmp (DT)
[ 62.779750] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 62.784524] pc : __list_add_valid+0x74/0xa0
[ 62.788690] lr : __list_add_valid+0x74/0xa0
[ 62.792855] sp : ffffff8008003da0
[ 62.796154] x29: ffffff8008003da0 x28: 0000000000000020
[ 62.801457] x27: 0000000000000000 x26: dead000000000100
[ 62.806760] x25: ffffffc07d308040 x24: ffffffc0540b40a0
[ 62.812064] x23: ffffffc07d308018 x22: 0000000000000000
[ 62.817359] x21: ffffffc07d308018 x20: ffffffc0540b40b8
[ 62.822654] x19: ffffffc0540b40b8 x18: ffffffffffffffff
[ 62.827957] x17: 0000000000000000 x16: 0000000000000000
[ 62.833252] x15: ffffff8008f88648 x14: 3034303830336437
[ 62.838546] x13: ffffff8008f88670 x12: ffffff80085d0ec0
[ 62.843841] x11: ffffff8008f65018 x10: 0000000000000006
[ 62.849136] x9 : 657270202e6e6f69 x8 : 3462303435306366
[ 62.854431] x7 : 66666666663d7665 x6 : 00000000000001a2
[ 62.859726] x5 : 0000000000000064 x4 : 0000000000000000
[ 62.865020] x3 : 0000000000000000 x2 : ffffffffffffffff
[ 62.870315] x1 : 0cbee765ba0ec900 x0 : 0000000000000000
[ 62.875611] Call trace:
[ 62.878042] __list_add_valid+0x74/0xa0
[ 62.881864] zynqmp_dma_free_descriptor+0x48/0x100
[ 62.886644] zynqmp_dma_chan_desc_cleanup+0xb4/0xf8
[ 62.891505] zynqmp_dma_do_tasklet+0x68/0x110
[ 62.895847] tasklet_action_common.isra.3+0x7c/0x168
[ 62.900801] tasklet_action+0x24/0x30
[ 62.904447] __do_softirq+0x10c/0x200
[ 62.908092] irq_exit+0xac/0xc0
[ 62.911219] __handle_domain_irq+0x60/0xb0
[ 62.915305] gic_handle_irq+0x64/0xc0
[ 62.918951] el1_irq+0xb0/0x140
[ 62.922078] schedule_timeout+0x218/0x3a0
[ 62.926077] wait_for_common+0x170/0x268
[ 62.929983] wait_for_completion_timeout+0x10/0x18
[ 62.934761] ioctl+0x64/0x270 [secom_mx_retune]
[ 62.939281] do_vfs_ioctl+0xb8/0x900
[ 62.942838] ksys_ioctl+0x44/0x90
[ 62.946137] __arm64_sys_ioctl+0x1c/0x28
[ 62.950044] el0_svc_common+0x60/0xe8
[ 62.953689] el0_svc_handler+0x6c/0x88
[ 62.957421] el0_svc+0x8/0xc
[ 62.960284] ---[ end trace 91b4fdfe685446c4 ]---
[ 62.964934] ------------[ cut here ]------------
---
drivers/dma/xilinx/zynqmp_dma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 931e41a72..a2b0be07e 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -453,6 +453,7 @@ static void zynqmp_dma_free_desc_list(struct zynqmp_dma_chan *chan,
list_for_each_entry_safe(desc, next, list, node)
zynqmp_dma_free_descriptor(chan, desc);
+ INIT_LIST_HEAD(list);
}
/**
--
2.20.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2020-04-28 14:34 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-28 14:32 Rafał Hibner [this message]
2020-04-28 14:32 ` [PATCH] dma: zynqmp_dma: Initialize descriptor list after freeing during reset Rafał Hibner
2020-05-02 12:32 ` Vinod Koul
2020-05-02 12:32 ` Vinod Koul
2020-05-02 13:00 ` Rafał Hibner
2020-05-02 13:00 ` Rafał Hibner
2020-05-04 5:16 ` Vinod Koul
2020-05-04 5:16 ` Vinod Koul
2020-05-04 5:33 ` Harini Katakam
2020-05-04 5:33 ` Harini Katakam
2020-05-06 10:28 ` [PATCH V2] dma: zynqmp_dma: Move list_del inside zynqmp_dma_free_descriptor Rafał Hibner
2020-05-06 10:28 ` Rafał Hibner
2020-05-15 5:50 ` Vinod Koul
2020-05-15 5:50 ` Vinod Koul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200428143225.3357-1-rafal.hibner@secom.com.pl \
--to=rafal.hibner@secom.com.pl \
--cc=appana.durga.rao@xilinx.com \
--cc=dan.j.williams@intel.com \
--cc=dmaengine@vger.kernel.org \
--cc=harini.katakam@xilinx.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michal.simek@xilinx.com \
--cc=radhey.shyam.pandey@xilinx.com \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.