mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	dmaengine: imx-dma: fix callback path in tasklet
We need to free the ld_active list head before jumping into the callback routine. Otherwise the callback could run into issue_pending and change our ld_active list head we just going to free. This will run the channel list into an currupted and undefined state. Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
This commit is contained in:
		
							parent
							
								
									5a276fa6bd
								
							
						
					
					
						commit
						fcaaba6c71
					
				
					 1 changed files with 6 additions and 4 deletions
				
			
		| 
						 | 
					@ -627,13 +627,11 @@ static void imxdma_tasklet(unsigned long data)
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	if (list_empty(&imxdmac->ld_active)) {
 | 
						if (list_empty(&imxdmac->ld_active)) {
 | 
				
			||||||
		/* Someone might have called terminate all */
 | 
							/* Someone might have called terminate all */
 | 
				
			||||||
		goto out;
 | 
							spin_unlock_irqrestore(&imxdma->lock, flags);
 | 
				
			||||||
 | 
							return;
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
	desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);
 | 
						desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	if (desc->desc.callback)
 | 
					 | 
				
			||||||
		desc->desc.callback(desc->desc.callback_param);
 | 
					 | 
				
			||||||
 | 
					 | 
				
			||||||
	/* If we are dealing with a cyclic descriptor, keep it on ld_active
 | 
						/* If we are dealing with a cyclic descriptor, keep it on ld_active
 | 
				
			||||||
	 * and dont mark the descriptor as complete.
 | 
						 * and dont mark the descriptor as complete.
 | 
				
			||||||
	 * Only in non-cyclic cases it would be marked as complete
 | 
						 * Only in non-cyclic cases it would be marked as complete
 | 
				
			||||||
| 
						 | 
					@ -661,6 +659,10 @@ static void imxdma_tasklet(unsigned long data)
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
out:
 | 
					out:
 | 
				
			||||||
	spin_unlock_irqrestore(&imxdma->lock, flags);
 | 
						spin_unlock_irqrestore(&imxdma->lock, flags);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
						if (desc->desc.callback)
 | 
				
			||||||
 | 
							desc->desc.callback(desc->desc.callback_param);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
 | 
					static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue