Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Robin Gong <yibin.gong@nxp.com>
To:     Krzysztof Kozlowski <krzk@kernel.org>,
        Vinod Koul <vkoul@kernel.org>,
        Dan Williams <dan.j.williams@intel.com>,
        Angelo Dureghello <angelo@sysam.it>,
        "dmaengine@vger.kernel.org" <dmaengine@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC:     Peng Ma <peng.ma@nxp.com>, Fabio Estevam <festevam@gmail.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: RE: [PATCH] dmaengine: mcf-edma: Fix NULL pointer exception in
 mcf_edma_tx_handler
Thread-Topic: [PATCH] dmaengine: mcf-edma: Fix NULL pointer exception in
 mcf_edma_tx_handler
Thread-Index: AQHWP/NB2exjiYlMX0OoWLZ0jRl7cqjUP9EA
Date:   Fri, 12 Jun 2020 02:20:23 +0000
Message-ID: <VE1PR04MB6638DCDB48DF10410C983A0A89810@VE1PR04MB6638.eurprd04.prod.outlook.com>
References: <1591877861-28156-2-git-send-email-krzk@kernel.org>
 <1591881665-25592-1-git-send-email-krzk@kernel.org>
In-Reply-To: <1591881665-25592-1-git-send-email-krzk@kernel.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 6dcade02-7c75-43c2-0953-08d80e7729b2
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jun 2020 02:20:23.4786
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: g1SuwCW7ubXaxuVbK2stBYLNIg5ZY06YB05jltZ4KvN9R7nMufI0CWf8crIRx+a31lG2VvmiK/ftmlQbcKo7HA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR04MB6352
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2020/06/11 Krzysztof Kozlowski <krzk@kernel.org> wrote:
> On Toradex Colibri VF50 (Vybrid VF5xx) with fsl-edma driver NULL pointer
> exception happens occasionally on serial output initiated by login timeou=
t.
>=20
> This was reproduced only if kernel was built with significant debugging o=
ptions
> and EDMA driver is used with serial console.
>=20
> Issue looks like a race condition between interrupt handler
> fsl_edma_tx_handler() (called as a result of fsl_edma_xfer_desc()) and
> terminating the transfer with fsl_edma_terminate_all().
>=20
> The fsl_edma_tx_handler() handles interrupt for a transfer with already f=
reed
> edesc and idle=3D=3Dtrue.
>=20
> The mcf-edma driver shares design and lot of code with fsl-edma.  It look=
s like
> being affected by same problem.  Fix this pattern the same way as fix for
> fsl-edma driver.
>=20
> Fixes: e7a3ff92eaf1 ("dmaengine: fsl-edma: add ColdFire mcf5441x edma
> support")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
>=20
> ---
>=20
> Not tested on HW.
> ---
>  drivers/dma/mcf-edma.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>=20
> diff --git a/drivers/dma/mcf-edma.c b/drivers/dma/mcf-edma.c index
> e15bd15a9ef6..e12b754e6398 100644
> --- a/drivers/dma/mcf-edma.c
> +++ b/drivers/dma/mcf-edma.c
> @@ -35,6 +35,13 @@ static irqreturn_t mcf_edma_tx_handler(int irq, void
> *dev_id)
>  			mcf_chan =3D &mcf_edma->chans[ch];
>=20
>  			spin_lock(&mcf_chan->vchan.lock);
> +
> +			if (!mcf_chan->edesc) {
> +				/* terminate_all called before */
> +				spin_unlock(&mcf_chan->vchan.lock);
> +				continue;
> +			}
> +
>  			if (!mcf_chan->edesc->iscyclic) {
>  				list_del(&mcf_chan->edesc->vdesc.node);
>  				vchan_cookie_complete(&mcf_chan->edesc->vdesc);
> --
> 2.7.4