Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ARM: 7136/1: pl330: Fix a race condition

If two requests have been submitted and one of them is running, if you
call pl330_chan_ctrl(ch_id, PL330_OP_START), there's a window of time
between the spin_lock_irqsave() and the _state() check in which the
running transaction may finish. In that case, we don't receive the
interrupt (because they are disabled), but _start() sees that the DMA
is stopped, so it starts it. The problem is that it sends the
transaction that has just finished again, because pl330_update()
hasn't mark it as done yet.

This patch fixes this race condition by not calling _start() if the
DMA is already executing transactions. When interrupts are reenabled,
pl330_update() will call _start().

Reference: <1317892206-3600-1-git-send-email-javi.merino@arm.com>

Signed-off-by: Javi Merino <javi.merino@arm.com>
Acked-by: Jassi Brar <jassi.brar@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

authored by

Javi Merino and committed by
Russell King
ee3f6158 b55fa188

+1 -1
+1 -1
arch/arm/common/pl330.c
··· 1546 1546 1547 1547 /* Start the next */ 1548 1548 case PL330_OP_START: 1549 - if (!_start(thrd)) 1549 + if (!_thrd_active(thrd) && !_start(thrd)) 1550 1550 ret = -EIO; 1551 1551 break; 1552 1552