On 07-12-18, 12:29, Shunyong Yang wrote: > When dma_cookie_complete() is called in hidma_process_completed(), > dma_cookie_status() will return DMA_COMPLETE in hidma_tx_status(). Then, > hidma_txn_is_success() will be called to use channel cookie > mchan->last_success to do additional DMA status check. Current code > assigns mchan->last_success after dma_cookie_complete(). This causes > a race condition of dma_cookie_status() returns DMA_COMPLETE before > mchan->last_success is assigned correctly. The race will cause > hidma_tx_status() return DMA_ERROR but the transaction is actually a > success. Moreover, in async_tx case, it will cause a timeout panic > in async_tx_quiesce(). > > Kernel panic - not syncing: async_tx_quiesce: DMA error waiting for > transaction > ... > Call trace: > [<ffff000008089994>] dump_backtrace+0x0/0x1f4 > [<ffff000008089bac>] show_stack+0x24/0x2c > [<ffff00000891e198>] dump_stack+0x84/0xa8 > [<ffff0000080da544>] panic+0x12c/0x29c > [<ffff0000045d0334>] async_tx_quiesce+0xa4/0xc8 [async_tx] > [<ffff0000045d03c8>] async_trigger_callback+0x70/0x1c0 [async_tx] > [<ffff0000048b7d74>] raid_run_ops+0x86c/0x1540 [raid456] > [<ffff0000048bd084>] handle_stripe+0x5e8/0x1c7c [raid456] > [<ffff0000048be9ec>] handle_active_stripes.isra.45+0x2d4/0x550 [raid456] > [<ffff0000048beff4>] raid5d+0x38c/0x5d0 [raid456] > [<ffff000008736538>] md_thread+0x108/0x168 > [<ffff0000080fb1cc>] kthread+0x10c/0x138 > [<ffff000008084d34>] ret_from_fork+0x10/0x18 > > Cc: Joey Zheng <[email protected]> > Signed-off-by: Shunyong Yang <[email protected]> > --- > drivers/dma/qcom/hidma.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > > diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c > index 9d639ed1955a..aa88bcceda20 100644 > --- a/drivers/dma/qcom/hidma.c > +++ b/drivers/dma/qcom/hidma.c > @@ -138,24 +138,24 @@ static void hidma_process_completed(struct hidma_chan > *mchan) > desc = &mdesc->desc; > last_cookie = desc->cookie; > > + llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch); > + > spin_lock_irqsave(&mchan->lock, irqflags); > + if (llstat == DMA_COMPLETE) { > + mchan->last_success = last_cookie; > + result.result = DMA_TRANS_NOERROR; > + } else > + result.result = DMA_TRANS_ABORTED;
Coding style mandates that else should also have braces, please fix that -- ~Vinod
