Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp4131503ybi; Mon, 29 Jul 2019 19:57:35 -0700 (PDT) X-Google-Smtp-Source: APXvYqxjw7Fej2qC/4iEPldrHHlFfHO9O2fnwC4bgv+4BJKHoz3dugPbmLmQySy50AWJVsymbJtS X-Received: by 2002:a65:6294:: with SMTP id f20mr109922696pgv.349.1564455455397; Mon, 29 Jul 2019 19:57:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1564455455; cv=none; d=google.com; s=arc-20160816; b=FMwyA5DaVGb29g/iqbomIeetfzeQ4+KImt7TWg+dU28wrgrwiw3Lits9SrCaxqBix6 vmfXZiz8Z1Yi4iuZ2k56Gg5GZSjj66de69S6aHvrZcwbKublxBT8WiNgL4SMZNZ+3VQK woM9bNBKJQgMIFmycFiMRO2udbDapM5MvpbkQCosasAmkXMguk1siT38dLK8X5+IkuiA 9E1hyNLyv5XyjOP4r7gTXBMm5bKByxyHEg7R4h6uYKvnUAW7V79vf8NxvnJ0b3vSsDqp VFCCo/BTwsSUkMhCIZRqHIFgJ68fiGHa0vnWqaQt5PzG/tuIIG1MZkPIobfQWLlBSt/g 4Hfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=737tPomSGuXL1qsm2PIpRn1vbaIIt3+8bS3O0wpWxGw=; b=MMrkUkQlGpDAJinTg8aU081+C/5EhApy1/kddVtivXja6USfgUb3Wp3MelQ1RWtita n6Y/lvy/im7Vvts2Ud33FwfrO7thmQsn56GfhwdUkmZSUFcLgwGlgiJL+LVdbwqqzdpQ WCy9Hw0AeBEJhB2Ek92A5Fo6PgDniVr0T8h4J5t2+ZFgSbaxXSeRUi4Q+ZKqqJNXs8ea Zg6wxaC9xyPZjRwDMxuqR1xAr3PsBSR7nI7cfy3Qcv8Qb8lwT7Qe/Q7D64Kr7HZuUYAi WzXc0e5avgI+l2QTIzFrD+sJcNhUn/jggTglSE1XAe4OGTMhWmGbaFLe0Ce5HsN57Ycj P2bw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="ko/owCY/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b20si27847913pgk.437.2019.07.29.19.56.59; Mon, 29 Jul 2019 19:57:35 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="ko/owCY/"; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403801AbfG2Tud (ORCPT + 99 others); Mon, 29 Jul 2019 15:50:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:41494 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2403793AbfG2Tuc (ORCPT ); Mon, 29 Jul 2019 15:50:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 98CE72054F; Mon, 29 Jul 2019 19:50:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564429831; bh=BEwfKRSa/76MFIw2dI4BUls0CbjO2fv1MWFO24Kis0Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ko/owCY/T8uzwtkzhAmeBMjVE5rBIKY7Io6ZStElH8Jgytd5nwt2kPXXu1fEL6+4N rtIHqLSfsOQqIlzqdZiHXpow2P+moWH69qlJjyunYo/1AytCKSXQBBLLFEptZ22+Ft z4fOHT2Kzi7XfERArQK4/YUMRDi58MBQXmT/HzQs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eugeniu Rosca , Yoshihiro Shimoda , Geert Uytterhoeven , Sasha Levin Subject: [PATCH 5.2 108/215] serial: sh-sci: Fix TX DMA buffer flushing and workqueue races Date: Mon, 29 Jul 2019 21:21:44 +0200 Message-Id: <20190729190757.592244849@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190729190739.971253303@linuxfoundation.org> References: <20190729190739.971253303@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit 8493eab02608b0e82f67b892aa72882e510c31d0 ] When uart_flush_buffer() is called, the .flush_buffer() callback zeroes the tx_dma_len field. This may race with the work queue function handling transmit DMA requests: 1. If the buffer is flushed before the first DMA API call, dmaengine_prep_slave_single() may be called with a zero length, causing the DMA request to never complete, leading to messages like: rcar-dmac e7300000.dma-controller: Channel Address Error happen and, with debug enabled: sh-sci e6e88000.serial: sci_dma_tx_work_fn: ffff800639b55000: 0...0, cookie 126 and DMA timeouts. 2. If the buffer is flushed after the first DMA API call, but before the second, dma_sync_single_for_device() may be called with a zero length, causing the transmit data not to be flushed to RAM, and leading to stale data being output. Fix this by: 1. Letting sci_dma_tx_work_fn() return immediately if the transmit buffer is empty, 2. Extending the critical section to cover all DMA preparational work, so tx_dma_len stays consistent for all of it, 3. Using local copies of circ_buf.head and circ_buf.tail, to make sure they match the actual operation above. Reported-by: Eugeniu Rosca Suggested-by: Yoshihiro Shimoda Signed-off-by: Geert Uytterhoeven Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Link: https://lore.kernel.org/r/20190624123540.20629-2-geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/tty/serial/sh-sci.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index 1d25c4e2d0d2..d18c680aa64b 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -1398,6 +1398,7 @@ static void sci_dma_tx_work_fn(struct work_struct *work) struct circ_buf *xmit = &port->state->xmit; unsigned long flags; dma_addr_t buf; + int head, tail; /* * DMA is idle now. @@ -1407,16 +1408,23 @@ static void sci_dma_tx_work_fn(struct work_struct *work) * consistent xmit buffer state. */ spin_lock_irq(&port->lock); - buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1)); + head = xmit->head; + tail = xmit->tail; + buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1)); s->tx_dma_len = min_t(unsigned int, - CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE), - CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE)); - spin_unlock_irq(&port->lock); + CIRC_CNT(head, tail, UART_XMIT_SIZE), + CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE)); + if (!s->tx_dma_len) { + /* Transmit buffer has been flushed */ + spin_unlock_irq(&port->lock); + return; + } desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len, DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT | DMA_CTRL_ACK); if (!desc) { + spin_unlock_irq(&port->lock); dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n"); goto switch_to_pio; } @@ -1424,18 +1432,18 @@ static void sci_dma_tx_work_fn(struct work_struct *work) dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len, DMA_TO_DEVICE); - spin_lock_irq(&port->lock); desc->callback = sci_dma_tx_complete; desc->callback_param = s; - spin_unlock_irq(&port->lock); s->cookie_tx = dmaengine_submit(desc); if (dma_submit_error(s->cookie_tx)) { + spin_unlock_irq(&port->lock); dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n"); goto switch_to_pio; } + spin_unlock_irq(&port->lock); dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n", - __func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx); + __func__, xmit->buf, tail, head, s->cookie_tx); dma_async_issue_pending(chan); return; -- 2.20.1