From: Tudor Ambarus <tudor.ambarus@microchip.com> To: <vkoul@kernel.org> Cc: <ludovic.desroches@microchip.com>, <nicolas.ferre@microchip.com>, <mripard@kernel.org>, <linux-arm-kernel@lists.infradead.org>, <dmaengine@vger.kernel.org>, <linux-kernel@vger.kernel.org>, Tudor Ambarus <tudor.ambarus@microchip.com> Subject: [PATCH v3 05/12] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Wed, 15 Dec 2021 13:01:08 +0200 [thread overview] Message-ID: <20211215110115.191749-6-tudor.ambarus@microchip.com> (raw) In-Reply-To: <20211215110115.191749-1-tudor.ambarus@microchip.com> The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fix the race for the tx desc callback by moving the xfer desc into the free desc list after the callback is invoked. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 83c031207530..d5b37459f906 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status); -- 2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: Tudor Ambarus <tudor.ambarus@microchip.com> To: <vkoul@kernel.org> Cc: Tudor Ambarus <tudor.ambarus@microchip.com>, mripard@kernel.org, linux-kernel@vger.kernel.org, ludovic.desroches@microchip.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH v3 05/12] dmaengine: at_xdmac: Fix race for the tx desc callback Date: Wed, 15 Dec 2021 13:01:08 +0200 [thread overview] Message-ID: <20211215110115.191749-6-tudor.ambarus@microchip.com> (raw) In-Reply-To: <20211215110115.191749-1-tudor.ambarus@microchip.com> The transfer descriptors were wrongly moved to the free descriptors list before calling the tx desc callback. As the DMA engine drivers drop any locks before calling the callback function, txd could be taken again, resulting in its callback called prematurely. Fix the race for the tx desc callback by moving the xfer desc into the free desc list after the callback is invoked. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com> --- drivers/dma/at_xdmac.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 83c031207530..d5b37459f906 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1582,20 +1582,6 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, return ret; } -/* Call must be protected by lock. */ -static void at_xdmac_remove_xfer(struct at_xdmac_chan *atchan, - struct at_xdmac_desc *desc) -{ - dev_dbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, desc); - - /* - * Remove the transfer from the transfer list then move the transfer - * descriptors into the free descriptors list. - */ - list_del(&desc->xfer_node); - list_splice_init(&desc->descs_list, &atchan->free_descs_list); -} - static void at_xdmac_advance_work(struct at_xdmac_chan *atchan) { struct at_xdmac_desc *desc; @@ -1704,7 +1690,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) txd = &desc->tx_dma_desc; dma_cookie_complete(txd); - at_xdmac_remove_xfer(atchan, desc); + /* Remove the transfer from the transfer list. */ + list_del(&desc->xfer_node); spin_unlock_irq(&atchan->lock); if (txd->flags & DMA_PREP_INTERRUPT) @@ -1713,6 +1700,8 @@ static void at_xdmac_tasklet(struct tasklet_struct *t) dma_run_dependencies(txd); spin_lock_irq(&atchan->lock); + /* Move the xfer descriptors into the free descriptors list. */ + list_splice_init(&desc->descs_list, &atchan->free_descs_list); at_xdmac_advance_work(atchan); spin_unlock_irq(&atchan->lock); } @@ -1859,8 +1848,10 @@ static int at_xdmac_device_terminate_all(struct dma_chan *chan) cpu_relax(); /* Cancel all pending transfers. */ - list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) - at_xdmac_remove_xfer(atchan, desc); + list_for_each_entry_safe(desc, _desc, &atchan->xfers_list, xfer_node) { + list_del(&desc->xfer_node); + list_splice_init(&desc->descs_list, &atchan->free_descs_list); + } clear_bit(AT_XDMAC_CHAN_IS_PAUSED, &atchan->status); clear_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status); -- 2.25.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-12-15 11:01 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-12-15 11:01 [PATCH v3 00/12] dmaengine: at_xdmac: Various fixes Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 01/12] dmaengine: at_xdmac: Don't start transactions at tx_submit level Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 02/12] dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 03/12] dmaengine: at_xdmac: Print debug message after realeasing the lock Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 04/12] dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus [this message] 2021-12-15 11:01 ` [PATCH v3 05/12] dmaengine: at_xdmac: Fix race for the tx desc callback Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 06/12] dmaengine: at_xdmac: Move the free desc to the tail of the desc list Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 07/12] dmaengine: at_xdmac: Fix concurrency over xfers_list Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 08/12] dmaengine: at_xdmac: Remove a level of indentation in at_xdmac_advance_work() Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 09/12] dmaengine: at_xdmac: Fix lld view setting Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 10/12] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 11/12] dmaengine: at_xdmac: Remove a level of indentation in at_xdmac_tasklet() Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2021-12-15 11:01 ` [PATCH v3 12/12] dmaengine: at_xdmac: Fix race over irq_status Tudor Ambarus 2021-12-15 11:01 ` Tudor Ambarus 2022-01-05 10:20 ` [PATCH v3 00/12] dmaengine: at_xdmac: Various fixes Vinod Koul 2022-01-05 10:20 ` Vinod Koul
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20211215110115.191749-6-tudor.ambarus@microchip.com \ --to=tudor.ambarus@microchip.com \ --cc=dmaengine@vger.kernel.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=ludovic.desroches@microchip.com \ --cc=mripard@kernel.org \ --cc=nicolas.ferre@microchip.com \ --cc=vkoul@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.