dmaengine: imx-dma: fix callback path in tasklet (fcaaba6c) · Commits · 戴 / test

We need to free the ld_active list head before jumping into the callback routine. Otherwise the callback could run into issue_pending and change our ld_active list head we just going to free. This will run the channel list into an currupted and undefined state. Signed-off-by:

Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by:

Vinod Koul <vinod.koul@intel.com>

drivers/dma/imx-dma.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -627,13 +627,11 @@ static void imxdma_tasklet(unsigned long data)

		if (list_empty(&imxdmac->ld_active)) {
		/* Someone might have called terminate all */
		goto out;
		spin_unlock_irqrestore(&imxdma->lock, flags);
		return;
		}
		desc = list_first_entry(&imxdmac->ld_active, struct imxdma_desc, node);

		if (desc->desc.callback)
		desc->desc.callback(desc->desc.callback_param);

		/* If we are dealing with a cyclic descriptor, keep it on ld_active
		* and dont mark the descriptor as complete.
		* Only in non-cyclic cases it would be marked as complete
		@@ -661,6 +659,10 @@ static void imxdma_tasklet(unsigned long data)
		}
		out:
		spin_unlock_irqrestore(&imxdma->lock, flags);

		if (desc->desc.callback)
		desc->desc.callback(desc->desc.callback_param);

		}

		static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,

Admin message