at_xdmac: txd used outside spinlock after being released?

From: Brent Taylor
Date: Tue Jul 19 2016 - 23:58:47 EST

Hi Ludovic,
I'm learning about the dmaengine subsystem and I was using the
at_xdmac as a reference. I'm not real familiar with tasklets
because I have used threaded interrupt handlers instead of them.
I noticed that the variable "txd" in the following block of code
(from the function at_xdmac_tasklet) is used after releasing the
atchan->lock and after the "desc" the txd is associated with is
returned back to the free descriptor list.

desc = list_first_entry(&atchan->xfers_list,
struct at_xdmac_desc,
txd = &desc->tx_dma_desc;

at_xdmac_remove_xfer(atchan, desc);

if (!at_xdmac_chan_is_cyclic(atchan)) {
if (txd->callback && (txd->flags & DMA_PREP_INTERRUPT))


Is there any danger of another process (maybe running on another
processor) changing desc->txd after it has been put back on the
My first thought was to move the spin_unlock_bh(&atchan->lock) untill
after dma_run_dependencies(txd), but a deadlock will be introduced
because dma_run_dependencies could invoke at_xdmac_issue_pending which
could eventually call spin_lock_irqsave(&atchan->lock). A deadlock
could also be created if the "callback" function invoked another
"device_prep_*" function.

If I'm miss-understanding something, I apologize for the noise.

-- Brent Taylor