Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chengfeng Ye <dg573847474@gmail.com>
To:     vkoul@kernel.org
Cc:     dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org,
        Chengfeng Ye <dg573847474@gmail.com>
Subject: [PATCH] dmaengine: k3dma: fix potential deadlock on &d->lock
Date:   Tue, 27 Jun 2023 16:08:17 +0000
Message-Id: <20230627160817.47353-1-dg573847474@gmail.com>
Precedence: bulk

As &d->lock is acquired by the tasklet k3_dma_tasklet() under softirq
context, other process context code acquring the lock should disable
irq or at least bottom-half irq. The dma terminate callback
k3_dma_terminate_all() and pause callback k3_dma_transfer_pause()
acquire the same lock but without closing irq.

I am not sure whether the two callbacks are already irq close in the
core, if not, then it would have the following deadlocks. But I saw
a spin_lock_irq() or another lock inside the terminate callback so
I guess not.

Possible deadlock scenario:
k3_dma_transfer_pause()
    -> spin_lock(&d->lock)
        <tasklet interrupt>
        -> k3_dma_tasklet()
        -> spin_lock_irq(&d->lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_irqsave(),
or it can be spin_lock_bh() if should be fixed?

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
---
 drivers/dma/k3dma.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
index ecdaada95120..ee398cb4ac11 100644
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -728,9 +728,9 @@ static int k3_dma_terminate_all(struct dma_chan *chan)
 	dev_dbg(d->slave.dev, "vchan %p: terminate all\n", &c->vc);
 
 	/* Prevent this channel being scheduled */
-	spin_lock(&d->lock);
+	spin_lock_irqsave(&d->lock, flags);
 	list_del_init(&c->node);
-	spin_unlock(&d->lock);
+	spin_unlock_irqrestore(&d->lock, flags);
 
 	/* Clear the tx descriptor lists */
 	spin_lock_irqsave(&c->vc.lock, flags);
@@ -764,6 +764,7 @@ static int k3_dma_transfer_pause(struct dma_chan *chan)
 	struct k3_dma_chan *c = to_k3_chan(chan);
 	struct k3_dma_dev *d = to_k3_dma(chan->device);
 	struct k3_dma_phy *p = c->phy;
+	unsigned long flags;
 
 	dev_dbg(d->slave.dev, "vchan %p: pause\n", &c->vc);
 	if (c->status == DMA_IN_PROGRESS) {
@@ -771,9 +772,9 @@ static int k3_dma_transfer_pause(struct dma_chan *chan)
 		if (p) {
 			k3_dma_pause_dma(p, false);
 		} else {
-			spin_lock(&d->lock);
+			spin_lock_irqsave(&d->lock, flags);
 			list_del_init(&c->node);
-			spin_unlock(&d->lock);
+			spin_unlock_irqrestore(&d->lock, flags);
 		}
 	}
 
-- 
2.17.1