This is a note to let you know that I've just added the patch titled dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: dmaengine-mv_xor_v2-properly-handle-wrapping-in-the-array-of-hw-descriptors.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 2aab4e18152cd30cb5d2f4c27629fc8a04aed979 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni <thomas.petazzoni@xxxxxxxxxxxxxxxxxx> Date: Fri, 5 May 2017 11:57:45 +0200 Subject: dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors From: Thomas Petazzoni <thomas.petazzoni@xxxxxxxxxxxxxxxxxx> commit 2aab4e18152cd30cb5d2f4c27629fc8a04aed979 upstream. mv_xor_v2_tasklet() is looping over completed HW descriptors. Before the loop, it initializes 'next_pending_hw_desc' to the first HW descriptor to handle, and then the loop simply increments this point, without taking care of wrapping when we reach the last HW descriptor. The 'pending_ptr' index was being wrapped back to 0 at the end, but it wasn't used in each iteration of the loop to calculate next_pending_hw_desc. This commit fixes that, and makes next_pending_hw_desc a variable local to the loop itself. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Signed-off-by: Thomas Petazzoni <thomas.petazzoni@xxxxxxxxxxxxxxxxxx> Signed-off-by: Vinod Koul <vinod.koul@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/dma/mv_xor_v2.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) --- a/drivers/dma/mv_xor_v2.c +++ b/drivers/dma/mv_xor_v2.c @@ -560,7 +560,6 @@ static void mv_xor_v2_tasklet(unsigned l { struct mv_xor_v2_device *xor_dev = (struct mv_xor_v2_device *) data; int pending_ptr, num_of_pending, i; - struct mv_xor_v2_descriptor *next_pending_hw_desc = NULL; struct mv_xor_v2_sw_desc *next_pending_sw_desc = NULL; dev_dbg(xor_dev->dmadev.dev, "%s %d\n", __func__, __LINE__); @@ -568,17 +567,10 @@ static void mv_xor_v2_tasklet(unsigned l /* get the pending descriptors parameters */ num_of_pending = mv_xor_v2_get_pending_params(xor_dev, &pending_ptr); - /* next HW descriptor */ - next_pending_hw_desc = xor_dev->hw_desq_virt + pending_ptr; - /* loop over free descriptors */ for (i = 0; i < num_of_pending; i++) { - - if (pending_ptr > MV_XOR_V2_DESC_NUM) - pending_ptr = 0; - - if (next_pending_sw_desc != NULL) - next_pending_hw_desc++; + struct mv_xor_v2_descriptor *next_pending_hw_desc = + xor_dev->hw_desq_virt + pending_ptr; /* get the SW descriptor related to the HW descriptor */ next_pending_sw_desc = @@ -614,6 +606,8 @@ static void mv_xor_v2_tasklet(unsigned l /* increment the next descriptor */ pending_ptr++; + if (pending_ptr >= MV_XOR_V2_DESC_NUM) + pending_ptr = 0; } if (num_of_pending != 0) { Patches currently in stable-queue which might be from thomas.petazzoni@xxxxxxxxxxxxxxxxxx are queue-4.9/dmaengine-mv_xor_v2-properly-handle-wrapping-in-the-array-of-hw-descriptors.patch queue-4.9/dmaengine-mv_xor_v2-enable-xor-engine-after-its-configuration.patch queue-4.9/dmaengine-mv_xor_v2-set-dma-mask-to-40-bits.patch queue-4.9/dmaengine-mv_xor_v2-do-not-use-descriptors-not-acked-by-async_tx.patch queue-4.9/dmaengine-mv_xor_v2-handle-mv_xor_v2_prep_sw_desc-error-properly.patch queue-4.9/dmaengine-mv_xor_v2-remove-interrupt-coalescing.patch queue-4.9/dmaengine-mv_xor_v2-fix-tx_submit-implementation.patch