On Wed, 26 Jul 2023 at 04:06, Chengfeng Ye <dg573847474@xxxxxxxxx> wrote:
>
> As &mc->vc.lock is acquired by milbeaut_hdmac_interrupt() under irq
> context, other acquisition of the same lock under process context should
> disable irq, otherwise deadlock could happen if the irq preempts the
> execution of process context code while the lock is held in process context
> on the same CPU.
>
> milbeaut_hdmac_chan_config(), milbeaut_hdmac_chan_resume() and
> milbeaut_hdmac_chan_pause() are such callback functions not disable irq by
> default.
>
> Possible deadlock scenario:
> milbeaut_hdmac_chan_config()
> -> spin_lock(&mc->vc.lock)
> <hard interruption>
> -> milbeaut_hdmac_interrupt()
> -> spin_lock(&mc->vc.lock); (deadlock here)
>
> This flaw was found by an experimental static analysis tool I am developing
> for irq-related deadlock.
>
> The tentative patch fixes the potential deadlock by spin_lock_irqsave() in
> the three callback functions to disable irq while lock is held.
>
> Signed-off-by: Chengfeng Ye <dg573847474@xxxxxxxxx>
> ---
> drivers/dma/milbeaut-hdmac.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/milbeaut-hdmac.c b/drivers/dma/milbeaut-hdmac.c
> index 1b0a95892627..6151c830ff6e 100644
> --- a/drivers/dma/milbeaut-hdmac.c
> +++ b/drivers/dma/milbeaut-hdmac.c
> @@ -214,10 +214,11 @@ milbeaut_hdmac_chan_config(struct dma_chan *chan, struct dma_slave_config *cfg)
> {
> struct virt_dma_chan *vc = to_virt_chan(chan);
> struct milbeaut_hdmac_chan *mc = to_milbeaut_hdmac_chan(vc);
> + unsigned long flags;
>
> - spin_lock(&mc->vc.lock);
> + spin_lock_irqsave(&mc->vc.lock, flags);
>
while at it, maybe also use vc->lock, instead of mc->vc.lock here and
in other two places, just like the rest of driver.
Acked-by: Jassi Brar <jaswinder.singh@xxxxxxxxxx>
thanks.
