shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 10:31:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

dmaengine: rockchip-dma: Fix potential concurrent on rk_dma_lch

Browse Source 
The LCH should always be accessed under lock protection to avoid
race conditions that could lead to null-pointer dereference.

Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Change-Id: I26ef5467c4d79236e1d52806fec7d60c0c34136f
This commit is contained in:
Sugar Zhang
2025-04-30 09:37:38 +08:00
parent d2c81f797c
commit 5887b5e6da
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/dma/rockchip-dma.c
View File

@@ -1092,7 +1092,7 @@ static int rk_dma_terminate_all(struct dma_chan *chan)
{
struct rk_dma_chan *c = to_rk_chan(chan);
struct rk_dma_dev *d = to_rk_dma(chan->device);
struct rk_dma_lch *l = c->lch;
struct rk_dma_lch *l;
unsigned long flags;
LIST_HEAD(head);
@@ -1103,6 +1103,7 @@ static int rk_dma_terminate_all(struct dma_chan *chan)
spin_unlock_irqrestore(&d->lock, flags);
spin_lock_irqsave(&c->vc.lock, flags);
l = c->lch;
if (l) {
rk_dma_terminate_chan(l, d);
if (l->ds_run)
@@ -1130,9 +1131,14 @@ static int rk_dma_transfer_pause(struct dma_chan *chan)
static int rk_dma_transfer_resume(struct dma_chan *chan)
{
struct rk_dma_chan *c = to_rk_chan(chan);
struct rk_dma_lch *l = c->lch;
struct rk_dma_lch *l;
unsigned long flags;
writel(LCH_TRF_CMD_DMA_RESUME, RK_DMA_LCH_TRF_CMD);
spin_lock_irqsave(&c->vc.lock, flags);
l = c->lch;
if (l)
writel(LCH_TRF_CMD_DMA_RESUME, RK_DMA_LCH_TRF_CMD);
spin_unlock_irqrestore(&c->vc.lock, flags);
return 0;
}