[PATCH v1 3/7] dmaengine: tegra-apb: Prevent race conditions on channel's freeing

From: Dmitry Osipenko
Date: Sat Dec 28 2019 - 15:47:55 EST


It's unsafe to check the channel's "busy" state without taking a lock,
it is also unsafe to assume that tasklet isn't in-fly.

Signed-off-by: Dmitry Osipenko <digetx@xxxxxxxxx>
---
drivers/dma/tegra20-apb-dma.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 664e9c5df3ba..28aff0b9763e 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -1294,8 +1294,8 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)

dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id);

- if (tdc->busy)
- tegra_dma_terminate_all(dc);
+ tegra_dma_terminate_all(dc);
+ tasklet_kill(&tdc->tasklet);

spin_lock_irqsave(&tdc->lock, flags);
list_splice_init(&tdc->pending_sg_req, &sg_req_list);
@@ -1543,7 +1543,6 @@ static int tegra_dma_probe(struct platform_device *pdev)
struct tegra_dma_channel *tdc = &tdma->channels[i];

free_irq(tdc->irq, tdc);
- tasklet_kill(&tdc->tasklet);
}

pm_runtime_disable(&pdev->dev);
@@ -1563,7 +1562,6 @@ static int tegra_dma_remove(struct platform_device *pdev)
for (i = 0; i < tdma->chip_data->nr_channels; ++i) {
tdc = &tdma->channels[i];
free_irq(tdc->irq, tdc);
- tasklet_kill(&tdc->tasklet);
}

pm_runtime_disable(&pdev->dev);
--
2.24.0