[PATCH 04/10] dmaengine: ptdma: Remove completed descriptor under vc.lock in pt_cmd_callback_work()

[Lee Jones <lee@kernel.org>]

pt_cmd_callback_work() drops chan->vc.lock before calling
list_del(&desc->vd.node), racing with concurrent virt-dma list
operations such as pt_terminate_all().

Move list_del(&desc->vd.node) inside the chan->vc.lock critical section,
matching pt_handle_active_desc().

Fixes: 656543989457 ("dmaengine: ptdma: Utilize the AE4DMA engine's multi-queue functionality")
Closes: https://sashiko.dev/#/bug/linux-55f1563b-5563-492a-a291-1a5b772ffd42
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/dma/amd/ptdma/ptdma-dmaengine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/amd/ptdma/ptdma-dmaengine.c b/drivers/dma/amd/ptdma/ptdma-dmaengine.c
index 405d3d3b7f8a..da50c7d15348 100644
--- a/drivers/dma/amd/ptdma/ptdma-dmaengine.c
+++ b/drivers/dma/amd/ptdma/ptdma-dmaengine.c
@@ -365,6 +365,7 @@ static void pt_cmd_callback_work(void *data, int err)
 
 		dma_cookie_complete(tx_desc);
 		dma_descriptor_unmap(tx_desc);
+		list_del(&desc->vd.node);
 	} else {
 		tx_desc = NULL;
 	}
@@ -373,7 +374,6 @@ static void pt_cmd_callback_work(void *data, int err)
 	if (tx_desc) {
 		dmaengine_desc_get_callback_invoke(tx_desc, NULL);
 		dma_run_dependencies(tx_desc);
-		list_del(&desc->vd.node);
 		vchan_vdesc_fini(vd);
 	}
 }
-- 
2.56.0.567.gdb80ae8cd5-goog