Re: [PATCH v14 12/12] dmaengine: imx-sdma: add terminated list for freed descriptor in worker

From: Lucas Stach
Date: Fri Jul 09 2021 - 05:55:56 EST


Am Mittwoch, dem 07.04.2021 um 23:30 +0800 schrieb Robin Gong:
> Add terminated list for keeping descriptor so that it could be freed in
> worker without any potential involving next descriptor raised up before
> this descriptor freed, because vchan_get_all_descriptors get all
> descriptors including the last terminated descriptor and the next
> descriptor, hence, the next descriptor maybe freed unexpectly when it's
> done in worker without this patch.
> https://www.spinics.net/lists/dmaengine/msg23367.html
>
> Signed-off-by: Robin Gong <yibin.gong@xxxxxxx>
> Reported-by: Richard Leitner <richard.leitner@xxxxxxxxxxx>

Reviewed-by: Lucas Stach <l.stach@xxxxxxxxxxxxxx>

> ---
> drivers/dma/imx-sdma.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
> index 9519b41..4174580 100644
> --- a/drivers/dma/imx-sdma.c
> +++ b/drivers/dma/imx-sdma.c
> @@ -381,6 +381,7 @@ struct sdma_channel {
> enum dma_status status;
> struct imx_dma_data data;
> struct work_struct terminate_worker;
> + struct list_head terminated;
> bool is_ram_script;
> };
>
> @@ -1041,9 +1042,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
> {
> struct sdma_channel *sdmac = container_of(work, struct sdma_channel,
> terminate_worker);
> - unsigned long flags;
> - LIST_HEAD(head);
> -
> /*
> * According to NXP R&D team a delay of one BD SDMA cost time
> * (maximum is 1ms) should be added after disable of the channel
> @@ -1052,10 +1050,7 @@ static void sdma_channel_terminate_work(struct work_struct *work)
> */
> usleep_range(1000, 2000);
>
> - spin_lock_irqsave(&sdmac->vc.lock, flags);
> - vchan_get_all_descriptors(&sdmac->vc, &head);
> - spin_unlock_irqrestore(&sdmac->vc.lock, flags);
> - vchan_dma_desc_free_list(&sdmac->vc, &head);
> + vchan_dma_desc_free_list(&sdmac->vc, &sdmac->terminated);
> }
>
> static int sdma_terminate_all(struct dma_chan *chan)
> @@ -1069,6 +1064,13 @@ static int sdma_terminate_all(struct dma_chan *chan)
>
> if (sdmac->desc) {
> vchan_terminate_vdesc(&sdmac->desc->vd);
> + /*
> + * move out current descriptor into terminated list so that
> + * it could be free in sdma_channel_terminate_work alone
> + * later without potential involving next descriptor raised
> + * up before the last descriptor terminated.
> + */
> + vchan_get_all_descriptors(&sdmac->vc, &sdmac->terminated);
> sdmac->desc = NULL;
> schedule_work(&sdmac->terminate_worker);
> }
> @@ -2075,6 +2077,7 @@ static int sdma_probe(struct platform_device *pdev)
>
> sdmac->channel = i;
> sdmac->vc.desc_free = sdma_desc_free;
> + INIT_LIST_HEAD(&sdmac->terminated);
> INIT_WORK(&sdmac->terminate_worker,
> sdma_channel_terminate_work);
> /*