Re: [PATCH v3 1/5] dmaengine: fsl-edma: Move error handler out of header file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unprotected write to channel status in the error handler causes a data race that can mask hardware errors and hang DMA clients.
--

commit cc17ac4f2b0c85f5476ae3803d0c9e31bd371d29
Author: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>

dmaengine: fsl-edma: Move error handler out of header file

This commit moves the fsl_edma_err_chan_handler function from an inline
definition in the header file to the common C file. This prepares the
driver for MCF ColdFire eDMA support, where the handler is called from
a specific interrupt handler.

> diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c
> index bb7531c456dfa..1b1a0496b5e6f 100644
> --- a/drivers/dma/fsl-edma-common.c
> +++ b/drivers/dma/fsl-edma-common.c
> @@ -44,6 +44,11 @@
>  #define EDMA64_ERRH		0x28
>  #define EDMA64_ERRL		0x2c
>  
> +void fsl_edma_err_chan_handler(struct fsl_edma_chan *fsl_chan)
> +{
> +	fsl_chan->status = DMA_ERROR;
> +}
> +

[Severity: High]
This is a pre-existing issue, but does this unlocked write to the channel
status create a race condition that could mask hardware errors?

If fsl_edma_tx_chan_handler() processes a completed transfer on CPU0, it
calls fsl_edma_xfer_desc() to start the next pending transfer. This enables
the hardware request and then assigns the channel status to DMA_IN_PROGRESS.

If the new transfer immediately triggers a hardware error, the error
interrupt fires on CPU1. CPU1 executes fsl_edma_err_chan_handler() and
writes DMA_ERROR to fsl_chan->status without acquiring the vchan.lock.

If CPU1's write occurs between the hardware request being enabled and CPU0's
write to DMA_IN_PROGRESS, the DMA_ERROR state is overwritten.

If the error is masked, the driver state remains DMA_IN_PROGRESS while the
hardware is permanently halted. Could this cause DMA clients to hang
indefinitely waiting for the failed transfer?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625-b4-edma-dmaengine-v3-0-44be00ace37d@yoseli.org?part=1