[PATCH 0/7] dmaengine: drain completion tasklets during teardown

[PATCH 0/7] dmaengine: drain completion tasklets during teardown

[Jiale Yao]

Several DMAengine drivers defer interrupt completion processing to
tasklets, but release channel resources without draining tasklets that
were already queued. Stopping or releasing an IRQ prevents new hard IRQ
handlers, but does not synchronize the deferred tasklet.

Depending on the driver, a late tasklet can access freed descriptor
storage or invoke a completion callback after its client data has been
released. Ensure each producer is stopped before killing the tasklet and
freeing the resources it can access.

Each patch is independent and keeps the synchronization local to one
driver's channel or device teardown path.

Jiale Yao (7):
  dmaengine: ep93xx: drain tasklet before freeing channel resources
  dmaengine: fsldma: drain channel tasklet during removal
  dmaengine: mmp_pdma: drain channel tasklets during removal
  dmaengine: mmp_tdma: synchronize tasklet when freeing a channel
  dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory
  dmaengine: mxs-dma: synchronize tasklet when freeing a channel
  dmaengine: ste_dma40: synchronize tasklet when releasing a channel

 drivers/dma/ep93xx_dma.c | 4 +++-
 drivers/dma/fsldma.c     | 1 +
 drivers/dma/mmp_pdma.c   | 4 ++++
 drivers/dma/mmp_tdma.c   | 2 ++
 drivers/dma/mv_xor.c     | 6 ++++--
 drivers/dma/mxs-dma.c    | 1 +
 drivers/dma/ste_dma40.c  | 2 ++
 7 files changed, 17 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 1/7] dmaengine: ep93xx: drain tasklet before freeing channel resources

[Jiale Yao]

The DMA interrupt handler can schedule the channel tasklet. Releasing
the IRQ waits for a running interrupt handler, but it does not drain a
tasklet that was already queued.

The channel resource release path frees the software descriptors and
disables the clock while such a tasklet can still access the channel and
invoke a completion callback.

Free the IRQ first to stop new tasklet producers, then kill the tasklet
before releasing the descriptors and clock.

Fixes: 5fa29a17fabf ("dmaengine: add ep93xx DMA support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/ep93xx_dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
index 311e55a97ba9..6134e9ca699d 100644
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -1015,11 +1015,13 @@ static void ep93xx_dma_free_chan_resources(struct dma_chan *chan)
 	list_splice_init(&edmac->free_list, &list);
 	spin_unlock_irqrestore(&edmac->lock, flags);
 
+	free_irq(edmac->irq, edmac);
+	tasklet_kill(&edmac->tasklet);
+
 	list_for_each_entry_safe(desc, d, &list, node)
 		kfree(desc);
 
 	clk_disable_unprepare(edmac->clk);
-	free_irq(edmac->irq, edmac);
 }
 
 /**
-- 
2.34.1

[PATCH 2/7] dmaengine: fsldma: drain channel tasklet during removal

[Jiale Yao]

The channel IRQ schedules a tasklet that accesses the channel descriptor
lists. Device removal frees the IRQs and then releases each channel
without draining tasklets that were already queued.

Kill each channel tasklet before unmapping and freeing the channel. The
removal path has already freed all controller or channel IRQs, so no
interrupt handler can queue the tasklet again.

Fixes: 173acc7ce853 ("dmaengine: add driver for Freescale MPC85xx DMA controller")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/fsldma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 22d62d958abd..0e2f84862261 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
 
 static void fsl_dma_chan_remove(struct fsldma_chan *chan)
 {
+	tasklet_kill(&chan->tasklet);
 	irq_dispose_mapping(chan->irq);
 	list_del(&chan->common.device_node);
 	iounmap(chan->regs);
-- 
2.34.1

[PATCH 3/7] dmaengine: mmp_pdma: drain channel tasklets during removal

[Jiale Yao]

PDMA interrupt handlers schedule per-channel tasklets that process
descriptor lists, invoke callbacks and return descriptors to their
pools. Freeing the IRQs does not drain tasklets that were already queued.

After freeing all controller or channel IRQs, kill every channel tasklet
before unregistering the DMA device and releasing its managed state.

Fixes: c8acd6aa6bed ("dmaengine: mmp-pdma support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/mmp_pdma.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index ed520737882b..a371f017fc3e 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1119,6 +1119,7 @@ static void dma_do_tasklet(struct tasklet_struct *t)
 static void mmp_pdma_remove(struct platform_device *op)
 {
 	struct mmp_pdma_device *pdev = platform_get_drvdata(op);
+	struct mmp_pdma_chan *chan;
 	struct mmp_pdma_phy *phy;
 	int i, irq = 0, irq_num = 0;
 
@@ -1141,6 +1142,9 @@ static void mmp_pdma_remove(struct platform_device *op)
 		}
 	}
 
+	list_for_each_entry(chan, &pdev->device.channels, chan.device_node)
+		tasklet_kill(&chan->tasklet);
+
 	dma_async_device_unregister(&pdev->device);
 }
 
-- 
2.34.1

[PATCH 4/7] dmaengine: mmp_tdma: synchronize tasklet when freeing a channel

[Jiale Yao]

The channel interrupt handler schedules a tasklet to invoke the transfer
completion callback. Channel resource release does not drain a tasklet
that was already queued, so a callback can run after its client state has
been released.

Disable the channel to stop the shared interrupt path from producing
more completions, release a dedicated IRQ when present, and kill the
tasklet before freeing the descriptor storage.

Fixes: c6da0ba8dfc8 ("dmaengine: mmp_tdma: add mmp tdma support")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/mmp_tdma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c
index ba03321eeff7..e0de0967d7e7 100644
--- a/drivers/dma/mmp_tdma.c
+++ b/drivers/dma/mmp_tdma.c
@@ -399,8 +399,10 @@ static void mmp_tdma_free_chan_resources(struct dma_chan *chan)
 {
 	struct mmp_tdma_chan *tdmac = to_mmp_tdma_chan(chan);
 
+	mmp_tdma_disable_chan(chan);
 	if (tdmac->irq)
 		devm_free_irq(tdmac->dev, tdmac->irq, tdmac);
+	tasklet_kill(&tdmac->tasklet);
 	mmp_tdma_free_descriptor(tdmac);
 	return;
 }
-- 
2.34.1

[PATCH 5/7] dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory

[Jiale Yao]

The XOR interrupt handler schedules irq_tasklet to clean channel
descriptor lists. Both device removal and late channel setup failures
can free the coherent descriptor pool while a previously queued tasklet
still refers to it.

Release the IRQ first so no new tasklet can be queued, kill the tasklet,
and only then free the descriptor pool and DMA mappings.

Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/mv_xor.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 25ed61f1b089..ec746cd16960 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1013,6 +1013,9 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
 
 	dma_async_device_unregister(&mv_chan->dmadev);
 
+	free_irq(mv_chan->irq, mv_chan);
+	tasklet_kill(&mv_chan->irq_tasklet);
+
 	dma_free_wc(dev, MV_XOR_POOL_SIZE,
 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
@@ -1025,8 +1028,6 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
 		list_del(&chan->device_node);
 	}
 
-	free_irq(mv_chan->irq, mv_chan);
-
 	return 0;
 }
 
@@ -1162,6 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 
 err_free_irq:
 	free_irq(mv_chan->irq, mv_chan);
+	tasklet_kill(&mv_chan->irq_tasklet);
 err_free_dma:
 	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
-- 
2.34.1

[PATCH 6/7] dmaengine: mxs-dma: synchronize tasklet when freeing a channel

[Jiale Yao]

The DMA interrupt handler schedules a per-channel tasklet to invoke the
completion callback. Releasing the IRQ does not drain a tasklet that was
already queued, so the callback can run after its client state has been
released.

Kill the tasklet after freeing the IRQ and before releasing the channel
command storage and clock.

Fixes: a580b8c5429a ("dmaengine: mxs-dma: add dma support for i.MX23/28")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/mxs-dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/mxs-dma.c b/drivers/dma/mxs-dma.c
index 7acb3d29dad3..9e85ba45f0fa 100644
--- a/drivers/dma/mxs-dma.c
+++ b/drivers/dma/mxs-dma.c
@@ -442,6 +442,7 @@ static void mxs_dma_free_chan_resources(struct dma_chan *chan)
 	mxs_dma_disable_chan(chan);
 
 	free_irq(mxs_chan->chan_irq, mxs_dma);
+	tasklet_kill(&mxs_chan->tasklet);
 
 	dma_free_coherent(mxs_dma->dma_device.dev, CCW_BLOCK_SIZE,
 			mxs_chan->ccw, mxs_chan->ccw_phys);
-- 
2.34.1

[PATCH 7/7] dmaengine: ste_dma40: synchronize tasklet when releasing a channel

[Jiale Yao]

DMA completion handling schedules a per-channel tasklet that processes
completed descriptors and invokes client callbacks. Channel release
terminates and frees the descriptor state without draining a tasklet
that was already queued.

After d40_free_dma() removes the channel from the interrupt lookup
tables, kill the tasklet before returning the channel to the DMAengine
core.

Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/ste_dma40.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0d9ffa3e2663..647a265590c2 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -2484,6 +2484,8 @@ static void d40_free_chan_resources(struct dma_chan *chan)
 	if (err)
 		chan_err(d40c, "Failed to free channel\n");
 	spin_unlock_irqrestore(&d40c->lock, flags);
+
+	tasklet_kill(&d40c->tasklet);
 }
 
 static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
-- 
2.34.1