| From 341198eda723c8c1cddbb006a89ad9e362502ea2 Mon Sep 17 00:00:00 2001 |
| From: Leonid Iziumtsev <leonid.iziumtsev@gmail.com> |
| Date: Tue, 15 Jan 2019 17:15:23 +0000 |
| Subject: dmaengine: imx-dma: fix wrong callback invoke |
| |
| From: Leonid Iziumtsev <leonid.iziumtsev@gmail.com> |
| |
| commit 341198eda723c8c1cddbb006a89ad9e362502ea2 upstream. |
| |
| Once the "ld_queue" list is not empty, next descriptor will migrate |
| into "ld_active" list. The "desc" variable will be overwritten |
| during that transition. And later the dmaengine_desc_get_callback_invoke() |
| will use it as an argument. As result we invoke wrong callback. |
| |
| That behaviour was in place since: |
| commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet"). |
| But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job") |
| things got worse, since possible delay between tasklet_schedule() |
| from DMA irq handler and actual tasklet function execution got bigger. |
| And that gave more time for new DMA request to be submitted and |
| to be put into "ld_queue" list. |
| |
| It has been noticed that DMA issue is causing problems for "mxc-mmc" |
| driver. While stressing the system with heavy network traffic and |
| writing/reading to/from sd card simultaneously the timeout may happen: |
| |
| 10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900) |
| |
| That often lead to file system corruption. |
| |
| Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@gmail.com> |
| Signed-off-by: Vinod Koul <vkoul@kernel.org> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/dma/imx-dma.c | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/dma/imx-dma.c |
| +++ b/drivers/dma/imx-dma.c |
| @@ -623,7 +623,7 @@ static void imxdma_tasklet(unsigned long |
| { |
| struct imxdma_channel *imxdmac = (void *)data; |
| struct imxdma_engine *imxdma = imxdmac->imxdma; |
| - struct imxdma_desc *desc; |
| + struct imxdma_desc *desc, *next_desc; |
| unsigned long flags; |
| |
| spin_lock_irqsave(&imxdma->lock, flags); |
| @@ -653,10 +653,10 @@ static void imxdma_tasklet(unsigned long |
| list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free); |
| |
| if (!list_empty(&imxdmac->ld_queue)) { |
| - desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc, |
| - node); |
| + next_desc = list_first_entry(&imxdmac->ld_queue, |
| + struct imxdma_desc, node); |
| list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active); |
| - if (imxdma_xfer_desc(desc) < 0) |
| + if (imxdma_xfer_desc(next_desc) < 0) |
| dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n", |
| __func__, imxdmac->channel); |
| } |