[PATCH v2] dmaengine: sun6i: Fix potential deadlock on sdev->lock
From: Hongling Zeng <hidden>
Date: 2026-07-06 03:03:57
Also in:
dmaengine, linux-sunxi, lkml, stable
Subsystem:
dma generic offload engine subsystem, the rest · Maintainers:
Vinod Koul, Linus Torvalds
sun6i_dma_terminate_all() and sun6i_dma_pause() acquire sdev->lock
with plain spin_lock() from process context. If a DMA interrupt fires
on the same CPU while the lock is held, the interrupt handler schedules
sun6i_dma_tasklet(), which runs in softirq context and attempts to
acquire the same lock with spin_lock_irq(), causing a deadlock.
Fix by using spin_lock_irq() to disable interrupts while holding
sdev->lock, consistent with other call sites.
Fixes: ba489fd46ab6 ("dmaengine: sun6i: Add support for Allwinner A31 DMA controller")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <redacted>
---
Change in v2:
-Fix by using spin_lock_irqsave() and spin_unlock_irqrestore() to
disable interrupts while holding sdev->lock and properly save/restore
interrupt state.
-Fix inconsistent locking pattern in sun6i_dma_resume() and
sun6i_dma_issue_pending().
---
drivers/dma/sun6i-dma.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index a9a254dbf8cb..742a0822a8da 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c@@ -891,6 +891,7 @@ static int sun6i_dma_pause(struct dma_chan *chan) struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device); struct sun6i_vchan *vchan = to_sun6i_vchan(chan); struct sun6i_pchan *pchan = vchan->phy; + unsigned long flags; dev_dbg(chan2dev(chan), "vchan %p: pause\n", &vchan->vc);
@@ -898,9 +899,9 @@ static int sun6i_dma_pause(struct dma_chan *chan) writel(DMA_CHAN_PAUSE_PAUSE, pchan->base + DMA_CHAN_PAUSE); } else { - spin_lock(&sdev->lock); + spin_lock_irqsave(&sdev->lock, flags); list_del_init(&vchan->node); - spin_unlock(&sdev->lock); + spin_unlock_irqrestore(&sdev->lock, flags); } return 0;
@@ -921,9 +922,9 @@ static int sun6i_dma_resume(struct dma_chan *chan) writel(DMA_CHAN_PAUSE_RESUME, pchan->base + DMA_CHAN_PAUSE); } else if (!list_empty(&vchan->vc.desc_issued)) { - spin_lock(&sdev->lock); + spin_lock_irq(&sdev->lock); list_add_tail(&vchan->node, &sdev->pending); - spin_unlock(&sdev->lock); + spin_unlock_irq(&sdev->lock); } spin_unlock_irqrestore(&vchan->vc.lock, flags);
@@ -939,9 +940,9 @@ static int sun6i_dma_terminate_all(struct dma_chan *chan) unsigned long flags; LIST_HEAD(head); - spin_lock(&sdev->lock); + spin_lock_irqsave(&sdev->lock, flags); list_del_init(&vchan->node); - spin_unlock(&sdev->lock); + spin_unlock_irqrestore(&sdev->lock, flags); spin_lock_irqsave(&vchan->vc.lock, flags);
@@ -1021,7 +1022,7 @@ static void sun6i_dma_issue_pending(struct dma_chan *chan) spin_lock_irqsave(&vchan->vc.lock, flags); if (vchan_issue_pending(&vchan->vc)) { - spin_lock(&sdev->lock); + spin_lock_irq(&sdev->lock); if (!vchan->phy && list_empty(&vchan->node)) { list_add_tail(&vchan->node, &sdev->pending);
@@ -1030,7 +1031,7 @@ static void sun6i_dma_issue_pending(struct dma_chan *chan) &vchan->vc); } - spin_unlock(&sdev->lock); + spin_unlock_irq(&sdev->lock); } else { dev_dbg(chan2dev(chan), "vchan %p: nothing to issue\n", &vchan->vc);
--
2.25.1