On Tue, Aug 23, 2016 at 2:16 AM, Hsin-Yu Chao <hychao@xxxxxxxxxxxx> wrote: > There is a racing when accessing dmac thread in pl330_tx_status that > the pl330_update is handling active request at the same time and > changing the status of descriptors. This could cause an invalid > transferred count from BUSY descriptor added up to the residual number. > Fix the bug by using the dmac's spinlock in pl330_tx_status to protect > thread resources from changing. > Note that the nested order of holding dmac's and dma_chan's spinlock is > consistent with the rest of the driver: dma_chan first and then dmac, > so it is safe from deadlock scenario. > > Signed-off-by: Hsin-Yu Chao <hychao@xxxxxxxxxxxx> Reviewed-by: Guenter Roeck <groeck@xxxxxxxxxxxx> > --- > drivers/dma/pl330.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c > index 2449cb7..bd6861b 100644 > --- a/drivers/dma/pl330.c > +++ b/drivers/dma/pl330.c > @@ -2306,6 +2306,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, > goto out; > > spin_lock_irqsave(&pch->lock, flags); > + spin_lock(&pch->thread->dmac->lock); > > if (pch->thread->req_running != -1) > running = pch->thread->req[pch->thread->req_running].desc; > @@ -2348,6 +2349,7 @@ pl330_tx_status(struct dma_chan *chan, dma_cookie_t cookie, > if (desc->last) > residual = 0; > } > + spin_unlock(&pch->thread->dmac->lock); > spin_unlock_irqrestore(&pch->lock, flags); > > out: > -- > 2.8.0.rc3.226.g39d4020 > -- To unsubscribe from this list: send the line "unsubscribe dmaengine" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
