From 8f6b6d0606023c8403ac04ba42177ecbb55769f6 Mon Sep 17 00:00:00 2001 From: Brad Kim Date: Thu, 3 Sep 2020 20:17:26 +0900 Subject: [PATCH] dmaengine: sf-pdma: Fix an error that calls callback twice Because a callback is called twice when DMA transfer complete the second callback may be possible to access a freed memory if the first callback routines perform the dma_release_channel function. So this patch serialized the callback functions Signed-off-by: Brad Kim Tested-and-reviewed-by: Green Wan Signed-off-by: Brad Kim Link: https://lore.kernel.org/r/20200903111726.3413-1-brad.kim@sifive.com Signed-off-by: Vinod Koul --- drivers/dma/sf-pdma/sf-pdma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c index 6e530dc..7549940 100644 --- a/drivers/dma/sf-pdma/sf-pdma.c +++ b/drivers/dma/sf-pdma/sf-pdma.c @@ -295,7 +295,10 @@ static void sf_pdma_donebh_tasklet(unsigned long arg) } spin_unlock_irqrestore(&chan->lock, flags); - dmaengine_desc_get_callback_invoke(desc->async_tx, NULL); + spin_lock_irqsave(&chan->vchan.lock, flags); + list_del(&chan->desc->vdesc.node); + vchan_cookie_complete(&chan->desc->vdesc); + spin_unlock_irqrestore(&chan->vchan.lock, flags); } static void sf_pdma_errbh_tasklet(unsigned long arg) @@ -332,8 +335,7 @@ static irqreturn_t sf_pdma_done_isr(int irq, void *dev_id) residue = readq(regs->residue); if (!residue) { - list_del(&chan->desc->vdesc.node); - vchan_cookie_complete(&chan->desc->vdesc); + tasklet_hi_schedule(&chan->done_tasklet); } else { /* submit next trascatioin if possible */ struct sf_pdma_desc *desc = chan->desc; @@ -347,8 +349,6 @@ static irqreturn_t sf_pdma_done_isr(int irq, void *dev_id) spin_unlock_irqrestore(&chan->vchan.lock, flags); - tasklet_hi_schedule(&chan->done_tasklet); - return IRQ_HANDLED; } -- 2.7.4