From: Joel Fernandes <joelf@ti.com>
To: Russell King - ARM Linux <linux@arm.linux.org.uk>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-omap@vger.kernel.org,
davinci-linux-open-source@linux.davincidsp.com,
Vinod Koul <vinod.koul@intel.com>,
Dan Williams <dan.j.williams@intel.com>
Subject: Re: [PATCH] [FIX] dmaengine: virt-dma: Free descriptor after callback
Date: Fri, 18 Apr 2014 11:34:50 -0500 [thread overview]
Message-ID: <5351542A.5080307@ti.com> (raw)
In-Reply-To: <20140418085019.GN27282@n2100.arm.linux.org.uk>
On 04/18/2014 03:50 AM, Russell King - ARM Linux wrote:
> On Thu, Apr 17, 2014 at 07:56:50PM -0500, Joel Fernandes wrote:
>> Free the vd (virt descriptor) after the callback is called. In EDMA driver
>> atleast which uses virt-dma, we make use of the desc during the callback and if
>> its dangerously freed before the callback is called. I also noticed this in
>> omap-dma dmaengine driver.
>
> You've missed the vital bit of information: why do you make use of the
> descriptor afterwards? You shouldn't. omap-dma doesn't either.
>
> Once clients submit their request to DMA engine, they must not hold any
> kind of reference to the descriptor other than the cookie.
>
Sorry, I confused edma/omap-dma callbacks for virt dma callbacks.
Anyway, I think there is still a chance in edma that we refer to the
echan->edesc pointer later on after virt-dma calls the free (in
edma_execute), so I'll just NULL that out to be safe and submit a patch.
Thanks.
regards,
-Joel
WARNING: multiple messages have this Message-ID (diff)
From: Joel Fernandes <joelf@ti.com>
To: Russell King - ARM Linux <linux@arm.linux.org.uk>
Cc: <dmaengine@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<linux-omap@vger.kernel.org>,
<davinci-linux-open-source@linux.davincidsp.com>,
Vinod Koul <vinod.koul@intel.com>,
Dan Williams <dan.j.williams@intel.com>
Subject: Re: [PATCH] [FIX] dmaengine: virt-dma: Free descriptor after callback
Date: Fri, 18 Apr 2014 11:34:50 -0500 [thread overview]
Message-ID: <5351542A.5080307@ti.com> (raw)
In-Reply-To: <20140418085019.GN27282@n2100.arm.linux.org.uk>
On 04/18/2014 03:50 AM, Russell King - ARM Linux wrote:
> On Thu, Apr 17, 2014 at 07:56:50PM -0500, Joel Fernandes wrote:
>> Free the vd (virt descriptor) after the callback is called. In EDMA driver
>> atleast which uses virt-dma, we make use of the desc during the callback and if
>> its dangerously freed before the callback is called. I also noticed this in
>> omap-dma dmaengine driver.
>
> You've missed the vital bit of information: why do you make use of the
> descriptor afterwards? You shouldn't. omap-dma doesn't either.
>
> Once clients submit their request to DMA engine, they must not hold any
> kind of reference to the descriptor other than the cookie.
>
Sorry, I confused edma/omap-dma callbacks for virt dma callbacks.
Anyway, I think there is still a chance in edma that we refer to the
echan->edesc pointer later on after virt-dma calls the free (in
edma_execute), so I'll just NULL that out to be safe and submit a patch.
Thanks.
regards,
-Joel
next prev parent reply other threads:[~2014-04-18 16:34 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-18 0:56 [PATCH] [FIX] dmaengine: virt-dma: Free descriptor after callback Joel Fernandes
2014-04-18 0:56 ` Joel Fernandes
[not found] ` <1397782610-7370-1-git-send-email-joelf-l0cyMroinI0@public.gmane.org>
2014-04-18 8:50 ` Russell King - ARM Linux
2014-04-18 8:50 ` Russell King - ARM Linux
2014-04-18 16:34 ` Joel Fernandes [this message]
2014-04-18 16:34 ` Joel Fernandes
2014-04-22 16:14 ` Vinod Koul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5351542A.5080307@ti.com \
--to=joelf@ti.com \
--cc=dan.j.williams@intel.com \
--cc=davinci-linux-open-source@linux.davincidsp.com \
--cc=dmaengine@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-omap@vger.kernel.org \
--cc=linux@arm.linux.org.uk \
--cc=vinod.koul@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.