From patchwork Tue May 3 12:14:58 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shardar Shariff Md X-Patchwork-Id: 617932 X-Patchwork-Delegate: jonathanh@nvidia.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3qzg9J5XwTz9sC4 for ; Tue, 3 May 2016 22:15:16 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932655AbcECMPQ (ORCPT ); Tue, 3 May 2016 08:15:16 -0400 Received: from hqemgate15.nvidia.com ([216.228.121.64]:16641 "EHLO hqemgate15.nvidia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932545AbcECMPO (ORCPT ); Tue, 3 May 2016 08:15:14 -0400 Received: from hqnvupgp07.nvidia.com (Not Verified[216.228.121.13]) by hqemgate15.nvidia.com id ; Tue, 03 May 2016 05:14:46 -0700 Received: from HQMAIL108.nvidia.com ([172.18.146.13]) by hqnvupgp07.nvidia.com (PGP Universal service); Tue, 03 May 2016 05:14:13 -0700 X-PGP-Universal: processed; by hqnvupgp07.nvidia.com on Tue, 03 May 2016 05:14:13 -0700 Received: from DRUKMAIL102.nvidia.com (10.25.59.20) by HQMAIL108.nvidia.com (172.18.146.13) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Tue, 3 May 2016 12:15:12 +0000 Received: from HQMAIL106.nvidia.com (172.18.146.12) by drukmail102.nvidia.com (10.25.59.20) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Tue, 3 May 2016 12:15:07 +0000 Received: from shardar-build-machine.nvidia.com (172.20.13.39) by HQMAIL106.nvidia.com (172.18.146.12) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Tue, 3 May 2016 12:15:03 +0000 From: Shardar Shariff Md To: , , , , , , , , , CC: Subject: [PATCH] dmaengine: tegra: crash fix observed during dma client(UART) stress testing Date: Tue, 3 May 2016 17:44:58 +0530 Message-ID: <1462277698-11360-1-git-send-email-smohammed@nvidia.com> X-Mailer: git-send-email 1.8.1.5 MIME-Version: 1.0 Sender: linux-tegra-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-tegra@vger.kernel.org During DMA client(UART) stress testing, observed below crash: [ 167.041591] Unable to handle kernel paging request at virtual address 00100108 [ 167.048818] pgd = ffffffc0de7ee000 [ 167.052222] [00100108] *pgd=0000000000000000 [ 167.056513] Internal error: Oops: 96000045 [#1] PREEMPT SMP [ 167.084048] Modules linked in: [ 167.087126] CPU: 0 PID: 1786 Comm: uarttest Tainted: G W 3.10.33-gb76f6f9 #5 [ 167.095040] task: ffffffc0a5ba6ac0 ti: ffffffc094380000 task.ti: ffffffc094380000 [ 167.102529] PC is at tegra_dma_tasklet+0x50/0xf4 [ 167.107148] LR is at tegra_dma_tasklet+0xc0/0xf4 [ 167.111767] pc : [] lr : [] pstate: 800001c5 [ 167.119155] sp : ffffffc094383a60 [ 167.122469] x29: ffffffc094383a60 x28: 0000000000000000 Issue: UART RX channel DMA completion EOC(End of completion) interrupt occurs and dma driver schedules tasklet() to execute callback function and empty the cb_desc (callback descriptor). Before dma driver tasklet runs, UART RX EORD (end of receive data) interrupt occurs. Here UART RX ISR handler calls tegra_dma_terminate_all() and re-configures the DMA for RX. While re-configuring, the cb_node data is re-initialized but the cb_desc list is not emptied. Now when dma driver tasklet callback function tries to check cb_desc and delete the cb_node (re-initialized node) kernel crashes. Fix: Empty the cb_desc data structure during tegra_dma_terminate_all() routine if there are no pending transfers. Signed-off-by: Shardar Shariff Md --- drivers/dma/tegra20-apb-dma.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c index 3871f29..34bb4cd 100644 --- a/drivers/dma/tegra20-apb-dma.c +++ b/drivers/dma/tegra20-apb-dma.c @@ -751,10 +751,8 @@ static int tegra_dma_terminate_all(struct dma_chan *dc) bool was_busy; spin_lock_irqsave(&tdc->lock, flags); - if (list_empty(&tdc->pending_sg_req)) { - spin_unlock_irqrestore(&tdc->lock, flags); - return 0; - } + if (list_empty(&tdc->pending_sg_req)) + goto empty_cblist; if (!tdc->busy) goto skip_dma_stop; @@ -787,6 +785,7 @@ static int tegra_dma_terminate_all(struct dma_chan *dc) skip_dma_stop: tegra_dma_abort_all(tdc); +empty_cblist: while (!list_empty(&tdc->cb_desc)) { dma_desc = list_first_entry(&tdc->cb_desc, typeof(*dma_desc), cb_node);