Commit 35929dae authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine 

Pull dmaengine fixes from Vinod Koul:

 - email address Update for Jie Hai

 - fix double increment of client_count in dma_chan_get()

 - idxd driver fixes: use after free, probe error handling and callback
   on wq disable

 - fix for qcom gpi driver GO tre

 - ptdma locking fix

 - tegra & imx-sdma mem leak fix

* tag 'dmaengine-fix-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  ptdma: pt_core_execute_cmd() should use spinlock
  dmaengine: tegra: Fix memory leak in terminate_all()
  dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
  dmaengine: Fix double increment of client_count in dma_chan_get()
  dmaengine: tegra210-adma: fix global intr clear
  Add exception protection processing for vd in axi_chan_handle_err function
  dmaengine: lgm: Move DT parsing after initialization
  MAINTAINERS: update Jie Hai's email address
  dmaengine: ti: k3-udma: Do conditional decrement of UDMA_CHAN_RT_PEER_BCNT_REG
  dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
  dmaengine: idxd: Prevent use after free on completion memory
  dmaengine: idxd: Let probe fail when workqueue cannot be enabled
  dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation
parents aaaf919c 95e5fda3

MAINTAINERS

+1 −1
Original line number Diff line number Diff line
@@ -9298,7 +9298,7 @@ F: net/dsa/tag_hellcreek.c 








HISILICON DMA DRIVER









M:	Zhou Wang <wangzhou1@hisilicon.com>









M:	Jie Hai <haijie1@hisilicon.com>









M:	Jie Hai <haijie1@huawei.com>









L:	dmaengine@vger.kernel.org









S:	Maintained









F:	drivers/dma/hisi_dma.c


































drivers/dma/dmaengine.c



+4
−3






























Original line number
Diff line number
Diff line







@@ -451,7 +451,8 @@ static int dma_chan_get(struct dma_chan *chan)







	/* The channel is already in use, update client count */









	if (chan->client_count) {









		__module_get(owner);









		goto out;









		chan->client_count++;









		return 0;









	}



















	if (!try_module_get(owner))










@@ -470,11 +471,11 @@ static int dma_chan_get(struct dma_chan *chan)







			goto err_out;









	}



















	chan->client_count++;



















	if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask))









		balance_ref_count(chan);



















out:









	chan->client_count++;









	return 0;



















err_out:


































drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c



+6
−0






























Original line number
Diff line number
Diff line







@@ -1018,6 +1018,11 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status)

















	/* The bad descriptor currently is in the head of vc list */









	vd = vchan_next_desc(&chan->vc);









	if (!vd) {









		dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n",









			axi_chan_name(chan));









		goto out;









	}









	/* Remove the completed descriptor from issued list */









	list_del(&vd->node);




















@@ -1032,6 +1037,7 @@ static noinline void axi_chan_handle_err(struct axi_dma_chan *chan, u32 status)







	/* Try to restart the controller */









	axi_chan_start_first_queued(chan);



















out:









	spin_unlock_irqrestore(&chan->vc.lock, flags);









}












































drivers/dma/idxd/device.c



+13
−3






























Original line number
Diff line number
Diff line







@@ -1172,8 +1172,19 @@ static void idxd_flush_pending_descs(struct idxd_irq_entry *ie)







	spin_unlock(&ie->list_lock);



















	list_for_each_entry_safe(desc, itr, &flist, list) {









		struct dma_async_tx_descriptor *tx;



















		list_del(&desc->list);









		ctype = desc->completion->status ? IDXD_COMPLETE_NORMAL : IDXD_COMPLETE_ABORT;









		/*









		 * wq is being disabled. Any remaining descriptors are









		 * likely to be stuck and can be dropped. callback could









		 * point to code that is no longer accessible, for example









		 * if dmatest module has been unloaded.









		 */









		tx = &desc->txd;









		tx->callback = NULL;









		tx->callback_result = NULL;









		idxd_dma_complete_txd(desc, ctype, true);









	}









}










@@ -1390,8 +1401,7 @@ int drv_enable_wq(struct idxd_wq *wq)







err_irq:









	idxd_wq_unmap_portal(wq);









err_map_portal:









	rc = idxd_wq_disable(wq, false);









	if (rc < 0)









	if (idxd_wq_disable(wq, false))









		dev_dbg(dev, "wq %s disable failed\n", dev_name(wq_confdev(wq)));









err:









	return rc;










@@ -1408,11 +1418,11 @@ void drv_disable_wq(struct idxd_wq *wq)







		dev_warn(dev, "Clients has claim on wq %d: %d\n",









			 wq->id, idxd_wq_refcount(wq));



















	idxd_wq_free_resources(wq);









	idxd_wq_unmap_portal(wq);









	idxd_wq_drain(wq);









	idxd_wq_free_irq(wq);









	idxd_wq_reset(wq);









	idxd_wq_free_resources(wq);









	percpu_ref_exit(&wq->wq_active);









	wq->type = IDXD_WQT_NONE;









	wq->client_count = 0;


































drivers/dma/imx-sdma.c



+3
−1






























Original line number
Diff line number
Diff line







@@ -1521,10 +1521,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,







		sdma_config_ownership(sdmac, false, true, false);



















	if (sdma_load_context(sdmac))









		goto err_desc_out;









		goto err_bd_out;



















	return desc;



















err_bd_out:









	sdma_free_bd(desc);









err_desc_out:









	kfree(desc);









err_out: