lkml.org 
[lkml]   [2019]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.20 327/352] dmaengine: imx-dma: fix wrong callback invoke
    Date
    4.20-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>

    commit 341198eda723c8c1cddbb006a89ad9e362502ea2 upstream.

    Once the "ld_queue" list is not empty, next descriptor will migrate
    into "ld_active" list. The "desc" variable will be overwritten
    during that transition. And later the dmaengine_desc_get_callback_invoke()
    will use it as an argument. As result we invoke wrong callback.

    That behaviour was in place since:
    commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet").
    But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job")
    things got worse, since possible delay between tasklet_schedule()
    from DMA irq handler and actual tasklet function execution got bigger.
    And that gave more time for new DMA request to be submitted and
    to be put into "ld_queue" list.

    It has been noticed that DMA issue is causing problems for "mxc-mmc"
    driver. While stressing the system with heavy network traffic and
    writing/reading to/from sd card simultaneously the timeout may happen:

    10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900)

    That often lead to file system corruption.

    Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@gmail.com>
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/dma/imx-dma.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/drivers/dma/imx-dma.c
    +++ b/drivers/dma/imx-dma.c
    @@ -618,7 +618,7 @@ static void imxdma_tasklet(unsigned long
    {
    struct imxdma_channel *imxdmac = (void *)data;
    struct imxdma_engine *imxdma = imxdmac->imxdma;
    - struct imxdma_desc *desc;
    + struct imxdma_desc *desc, *next_desc;
    unsigned long flags;

    spin_lock_irqsave(&imxdma->lock, flags);
    @@ -648,10 +648,10 @@ static void imxdma_tasklet(unsigned long
    list_move_tail(imxdmac->ld_active.next, &imxdmac->ld_free);

    if (!list_empty(&imxdmac->ld_queue)) {
    - desc = list_first_entry(&imxdmac->ld_queue, struct imxdma_desc,
    - node);
    + next_desc = list_first_entry(&imxdmac->ld_queue,
    + struct imxdma_desc, node);
    list_move_tail(imxdmac->ld_queue.next, &imxdmac->ld_active);
    - if (imxdma_xfer_desc(desc) < 0)
    + if (imxdma_xfer_desc(next_desc) < 0)
    dev_warn(imxdma->dev, "%s: channel: %d couldn't xfer desc\n",
    __func__, imxdmac->channel);
    }

    \
     
     \ /
      Last update: 2019-02-11 16:54    [W:3.479 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site