dmaengine: at_hdmac: Fix premature completion of desc in issue_pending

commit fcd37565efdaffeac179d0f0ce980ac79bfdf569 upstream.

Multiple calls to atc_issue_pending() could result in a premature
completion of a descriptor from the atchan->active list, as the method
always completed the first active descriptor from the list. Instead,
issue_pending() should just take the first transaction descriptor from the
pending queue, move it to active_list and start the transfer.

Fixes: dc78baa2b90b ("dmaengine: at_hdmac: new driver for the Atmel AHB DMA Controller")
Reported-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/lkml/13c6c9a2-6db5-c3bf-349b-4c127ad3496a@axentia.se/
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20221025090306.297886-1-tudor.ambarus@microchip.com
Link: https://lore.kernel.org/r/20221025090306.297886-5-tudor.ambarus@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 8f45cd6..e5bfc63 100644 (file)
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1519,16 +1519,26 @@ atc_tx_status(struct dma_chan *chan,
 }
 
 /**
- * atc_issue_pending - try to finish work
+ * atc_issue_pending - takes the first transaction descriptor in the pending
+ * queue and starts the transfer.
  * @chan: target DMA channel
  */
 static void atc_issue_pending(struct dma_chan *chan)
 {
-       struct at_dma_chan      *atchan = to_at_dma_chan(chan);
+       struct at_dma_chan *atchan = to_at_dma_chan(chan);
+       struct at_desc *desc;
+       unsigned long flags;
 
        dev_vdbg(chan2dev(chan), "issue_pending\n");
 
-       atc_advance_work(atchan);
+       spin_lock_irqsave(&atchan->lock, flags);
+       if (atc_chan_is_enabled(atchan) || list_empty(&atchan->queue))
+               return spin_unlock_irqrestore(&atchan->lock, flags);
+
+       desc = atc_first_queued(atchan);
+       list_move_tail(&desc->desc_node, &atchan->active_list);
+       atc_dostart(atchan, desc);
+       spin_unlock_irqrestore(&atchan->lock, flags);
 }
 
 /**