From: Hannu Koivisto <hannu.koivisto@xxxxxxxxx> dma_rx_callback() may see NULL dma_chan_rx if DMA interrupt [1] occurs a moment[2] before imx_uart_dma_exit() sets it to NULL. imx_uart_dma_exit() calls dmaengine_terminate_all() and dma_release_channel() but neither of those prevent the callback being called after they have returned. A similar problem has been discussed by ALSA developers (http://mailman.alsa-project.org/pipermail/alsa-devel/2013-October/067239.html) and it was pointed out that dmaengine_terminate_all() might be called from the callback, so we cannot call tasklet_kill() in imx-sdma's code called by dmaengine_terminate_all(). Hopefully it doesn't make sense to call dma_release_channel() from the callback, so instead of adding synchronization to imx serial driver, we add tasklet_kill() call to sdma_free_chan_resources(). While most DMA drivers don't do that, there is one example that does: pl330. [1] It schedules sdma_tasklet, which again calls the dma_rx_callback. [2] I tested this by scheduling the sdma tasklet as far as right before the imx_stop_tx() call in imx_shutdown() and the problem occurred. Signed-off-by: Fabien Lahoudere <fabien.lahoudere@xxxxxxxxxxxxxxx> --- drivers/dma/imx-sdma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c index 46c9027..da86792 100644 --- a/drivers/dma/imx-sdma.c +++ b/drivers/dma/imx-sdma.c @@ -1135,6 +1135,8 @@ static void sdma_free_chan_resources(struct dma_chan *chan) sdma_disable_channel(chan); + tasklet_kill(&sdmac->tasklet); + if (sdmac->event_id0) sdma_event_disable(sdmac, sdmac->event_id0); if (sdmac->event_id1) -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe dmaengine" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
