linux-toradex.git/drivers/dma/ste_dma40.c, branch v3.2.59 Linux kernel for Apalis and Colibri modules dma: ste_dma40: don't dereference free:d descriptor 2014-04-01T23:58:53+00:00 Linus Walleij linus.walleij@linaro.org 2014-02-13T09:39:01+00:00 74f925dea76124060a2021460a26c6ddc815bfff commit e9baa9d9d520fb0e24cca671e430689de2d4a4b2 upstream. It appears that in the DMA40 driver the DMA tasklet will very often dereference memory for a descriptor just free:d from the DMA40 slab. Nothing happens because no other part of the driver has yet had a chance to claim this memory, but it's really nasty to dereference free:d memory, so let's check the flag before the descriptor is free and store it in a bool variable. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 
commit e9baa9d9d520fb0e24cca671e430689de2d4a4b2 upstream.

It appears that in the DMA40 driver the DMA tasklet will very
often dereference memory for a descriptor just free:d from the
DMA40 slab. Nothing happens because no other part of the driver
has yet had a chance to claim this memory, but it's really
nasty to dereference free:d memory, so let's check the flag
before the descriptor is free and store it in a bool variable.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/dma: Add export.h to ste_dma40.c 2011-10-31T23:31:44+00:00 Paul Gortmaker paul.gortmaker@windriver.com 2011-07-31T20:17:36+00:00 f492b21027272369953f68ee341df38dffa962fb Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> 
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
dmaengine/ste_dma40: fix memory leak due to prepared descriptors 2011-09-05T11:38:26+00:00 Per Forlin per.forlin@linaro.org 2011-08-29T11:33:35+00:00 82babbb361f207a80cffa8ac34c2b6a0b62acc88 Prepared descriptors that are not submitted will not be freed. Add prepared descriptor to a list to be able to release them upon dmaengine_terminate_all(). Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
Prepared descriptors that are not submitted will not be freed. Add
prepared descriptor to a list to be able to release them upon
dmaengine_terminate_all().

Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dmaengine/ste_dma40: fix Oops due to double free of client descriptor 2011-09-05T11:37:58+00:00 Per Forlin per.forlin@linaro.org 2011-08-29T11:33:34+00:00 7404368c22b4910ab839238e48d96be45180f6fc The client list may exist in two lists at the same time. This makes free fail since the same desc is freed multiple times. Remove desc from client list when adding it to the pending queue. Move free of client owned descriptors from free_dma() to terminate_all(). Unable to handle kernel paging request at virtual address 00100104 pgd = dea8c000 [00100104] *pgd=1ea62831, *pte=00000000, *ppte=00000000 Internal error: Oops: 817 [#1] PREEMPT SMP Modules linked in: CPU: 0 Not tainted (3.1.0-rc3+ #58) PC is at d40_free_chan_resources+0x64/0x330 Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
The client list may exist in two lists at the same time. This makes free
fail since the same desc is freed multiple times. Remove desc from
client list when adding it to the pending queue. Move free of client owned
descriptors from free_dma() to terminate_all().

Unable to handle kernel paging request at virtual address 00100104
pgd = dea8c000
[00100104] *pgd=1ea62831, *pte=00000000, *ppte=00000000
Internal error: Oops: 817 [#1] PREEMPT SMP
Modules linked in:
CPU: 0    Not tainted  (3.1.0-rc3+ #58)
PC is at d40_free_chan_resources+0x64/0x330

Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free(). 2011-09-05T11:37:28+00:00 Per Forlin per.forlin@linaro.org 2011-08-29T11:33:33+00:00 3b3d5b0f855b3eec45a02832e97c3c1890ff8823 d40_desc_free() already calls d40_pool_lli_free(). Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
d40_desc_free() already calls d40_pool_lli_free().

Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dmaengine/ste_dma40: add missing kernel doc for pending_queue 2011-09-05T11:37:03+00:00 Per Forlin per.forlin@linaro.org 2011-08-29T11:33:32+00:00 da063d260969c4e5e5f91d911ba87f7f6b48ead0 Signed-off-by: Per Forlin <per.forlin@linaro.org> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
Signed-off-by: Per Forlin <per.forlin@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma 2011-08-01T23:46:37+00:00 Linus Torvalds torvalds@linux-foundation.org 2011-08-01T23:46:37+00:00 12ff47e7f5fb64c566f62e6cf6a3b291c51bd337 * 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma: (37 commits) Improve slave/cyclic DMA engine documentation dmaengine: pl08x: handle the rest of enums in pl08x_width DMA: PL08x: cleanup selection of burst size DMA: PL08x: avoid recalculating cctl at each prepare DMA: PL08x: cleanup selection of buswidth DMA: PL08x: constify plchan->cd and plat->slave_channels DMA: PL08x: separately store source/destination cctl DMA: PL08x: separately store source/destination slave address DMA: PL08x: clean up LLI debugging DMA: PL08x: select LLI bus only once per LLI setup DMA: PL08x: remove unused constants ARM: mxs-dma: reset after disable channel dma: intel_mid_dma: remove redundant pci_set_drvdata calls dma: mxs-dma: fix unterminated platform_device_id table dmaengine: pl330: make platform data optional dmaengine: imx-sdma: return proper error if kzalloc fails pch_dma: Fix CTL register access issue dmaengine: mxs-dma: skip request_irq for NO_IRQ dmaengine/coh901318: fix slave submission semantics dmaengine/ste_dma40: allow memory buswidth/burst to be configured ... Fix trivial whitespace conflict in drivers/dma/mv_xor.c 
* 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma: (37 commits)
  Improve slave/cyclic DMA engine documentation
  dmaengine: pl08x: handle the rest of enums in pl08x_width
  DMA: PL08x: cleanup selection of burst size
  DMA: PL08x: avoid recalculating cctl at each prepare
  DMA: PL08x: cleanup selection of buswidth
  DMA: PL08x: constify plchan->cd and plat->slave_channels
  DMA: PL08x: separately store source/destination cctl
  DMA: PL08x: separately store source/destination slave address
  DMA: PL08x: clean up LLI debugging
  DMA: PL08x: select LLI bus only once per LLI setup
  DMA: PL08x: remove unused constants
  ARM: mxs-dma: reset after disable channel
  dma: intel_mid_dma: remove redundant pci_set_drvdata calls
  dma: mxs-dma: fix unterminated platform_device_id table
  dmaengine: pl330: make platform data optional
  dmaengine: imx-sdma: return proper error if kzalloc fails
  pch_dma: Fix CTL register access issue
  dmaengine: mxs-dma: skip request_irq for NO_IRQ
  dmaengine/coh901318: fix slave submission semantics
  dmaengine/ste_dma40: allow memory buswidth/burst to be configured
  ...

Fix trivial whitespace conflict in drivers/dma/mv_xor.c
dmaengine/ste_dma40: allow memory buswidth/burst to be configured 2011-07-13T22:39:10+00:00 Rabin Vincent rabin.vincent@stericsson.com 2011-06-27T09:33:38+00:00 98ca528916c47ad17f78a07b45e49de3940fba77 Currently the runtime config implementation forces the memory side parameters to be the same as the peripheral side. Allow these to be different, and check for misconfiguration. Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com> Reviewed-by: Ulf HANSSON <ulf.hansson@stericsson.com> Tested-by: Stefan Nilsson <stefan.xk.nilsson@stericsson.com> Reviewed-by: Per Forlin <per.forlin@stericsson.com> Reviewed-by: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com> Cc: Robert Marklund <robert.marklund@stericsson.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
Currently the runtime config implementation forces the memory side
parameters to be the same as the peripheral side. Allow these to be
different, and check for misconfiguration.

Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com>
Reviewed-by: Ulf HANSSON <ulf.hansson@stericsson.com>
Tested-by: Stefan Nilsson <stefan.xk.nilsson@stericsson.com>
Reviewed-by: Per Forlin <per.forlin@stericsson.com>
Reviewed-by: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Robert Marklund <robert.marklund@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dmaengine/ste_dma40: use AMBA PrimeCell helper macros 2011-07-13T22:39:10+00:00 Linus Walleij linus.walleij@linaro.org 2011-06-27T09:33:46+00:00 f4b89764c470230bbf9d18c0a3411887c48bb5a2 The DMA40 is not a PrimeCell from ARM, but it still use the same ID registers. So let's utilize the existing macros in the PrimeCell header to identify manufacturer and revision of the IP block instead of reinventing the wheel. Cc: Robert Marklund <robert.marklund@stericsson.com> Cc: Per Forlin <per.forlin@linaro.org> Cc: Rabin Vincent <rabin.vincent@stericsson.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
The DMA40 is not a PrimeCell from ARM, but it still use the same
ID registers. So let's utilize the existing macros in the
PrimeCell header to identify manufacturer and revision of the IP
block instead of reinventing the wheel.

Cc: Robert Marklund <robert.marklund@stericsson.com>
Cc: Per Forlin <per.forlin@linaro.org>
Cc: Rabin Vincent <rabin.vincent@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
dmaengine/ste_dma40: make the cyclic alloc NOWAIT 2011-07-13T22:39:10+00:00 Robert Marklund robert.marklund@stericsson.com 2011-06-27T09:33:24+00:00 79ca7ec3d1046a79c64f95f0cac0f5fd29829f53 This function may be initiated from IRQ context, so the allocation must allocate NOWAIT memory. Signed-off-by: Robert Marklund <robert.marklund@stericsson.com> Reviewed-by: Rabin Vincent <rabin.vincent@stericsson.com> Reviewed-by: Philippe Langlais <philippe.langlais@stericsson.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Vinod Koul <vinod.koul@intel.com> 
This function may be initiated from IRQ context, so the allocation
must allocate NOWAIT memory.

Signed-off-by: Robert Marklund <robert.marklund@stericsson.com>
Reviewed-by: Rabin Vincent <rabin.vincent@stericsson.com>
Reviewed-by: Philippe Langlais <philippe.langlais@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>