Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fcaaba6c authored by Michael Grzeschik's avatar Michael Grzeschik Committed by Vinod Koul
Browse files

dmaengine: imx-dma: fix callback path in tasklet 



We need to free the ld_active list head before jumping into the callback
routine. Otherwise the callback could run into issue_pending and change
our ld_active list head we just going to free. This will run the channel
list into an currupted and undefined state.

Signed-off-by: default avatarMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
parent 5a276fa6

drivers/dma/imx-dma.c

+6 −4
Original line number Diff line number Diff line
@@ -627,13 +627,11 @@ static void imxdma_tasklet(unsigned long data) 


	if (list_empty(&imxdmac->ld_active)) {

		/* Someone might have called terminate all */

		goto out;

		spin_unlock_irqrestore(&imxdma->lock, flags);

		return;

	}

	desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);



	if (desc->desc.callback)

		desc->desc.callback(desc->desc.callback_param);



	/* If we are dealing with a cyclic descriptor, keep it on ld_active

	 * and dont mark the descriptor as complete.

	 * Only in non-cyclic cases it would be marked as complete
@@ -661,6 +659,10 @@ static void imxdma_tasklet(unsigned long data) 
	}

out:

	spin_unlock_irqrestore(&imxdma->lock, flags);



	if (desc->desc.callback)

		desc->desc.callback(desc->desc.callback_param);



}



static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,