From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753831AbbCCHXP (ORCPT <rfc822;w@1wt.eu>);
	Tue, 3 Mar 2015 02:23:15 -0500
Received: from smtp-out-203.synserver.de ([212.40.185.203]:1601 "EHLO
	smtp-out-193.synserver.de" rhost-flags-OK-OK-OK-FAIL)
	by vger.kernel.org with ESMTP id S1752683AbbCCHXN (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Tue, 3 Mar 2015 02:23:13 -0500
X-SynServer-TrustedSrc: 1
X-SynServer-AuthUser: lars@metafoo.de
X-SynServer-PPID: 7422
Message-ID: <54F5615E.3070106@metafoo.de>
Date: Tue, 03 Mar 2015 08:23:10 +0100
From: Lars-Peter Clausen <lars@metafoo.de>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Icedove/31.4.0
MIME-Version: 1.0
To: Robert Jarzmik <robert.jarzmik@free.fr>
CC: Vinod Koul <vinod.koul@intel.com>, dmaengine@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] dmaengine: virt-dma: fix completion list manipulation
References: <1425331196-7895-1-git-send-email-robert.jarzmik@free.fr>	<54F4D631.6020605@metafoo.de> <87fv9n12h6.fsf@free.fr>
In-Reply-To: <87fv9n12h6.fsf@free.fr>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 03/02/2015 11:03 PM, Robert Jarzmik wrote:
> Lars-Peter Clausen <lars@metafoo.de> writes:
>
>> On 03/02/2015 10:19 PM, Robert Jarzmik wrote:
>>> diff --git a/drivers/dma/virt-dma.h b/drivers/dma/virt-dma.h
>>> index 3772032..2a3da22 100644
>>> --- a/drivers/dma/virt-dma.h
>>> +++ b/drivers/dma/virt-dma.h
>>> @@ -91,7 +91,7 @@ static inline void vchan_cookie_complete(struct virt_dma_desc *vd)
>>>    	dma_cookie_complete(&vd->tx);
>>>    	dev_vdbg(vc->chan.device->dev, "txd %p[%x]: marked complete\n",
>>>    		 vd, cookie);
>>> -	list_add_tail(&vd->node, &vc->desc_completed);
>>> +	list_move_tail(&vd->node, &vc->desc_completed);
>>
>> That will break all drivers which handle this currently correctly and remove the
>> descriptor from any list before calling vchan_cookie_complete.
> Ah, well well I don't agree.
>
> First, let's split the drivers which remove the descriptors and these which
> don't :
>
> These which remove the descriptor:
> dma-jz4740.c
> fsl-edma.c
>
> These which don't remove the descriptor:
> amba-pl08x.c
> edma.c
> img-mdc-dma.c
> k3dma.c
> moxart-dma.c
> omap-dma.c
> qcom_bam_dma.c
> s3c24xx-dma.c
> sa11x0-dma.c
> sun6i-dma.c

All of those remove the descriptor from the list when they start the transfer.

>
> That settles the correctness I think, the correct behavior is to not remove the
> descriptor and let it be done by vchan_cookie_complete().
>
> Now for the remaining 2 drivers, we'll have :
>   - list_del(&vd->node) => vd becomes a singleton
>   - list_move_tail(&vd->node, &...desc_completed)
>     => list_del(&vd->node) : nothing changes, it's a nop
>     => list_add_tail(&vd->node, &...desc_completed)
>
> And the behavior remains correct after the patch, only one "list_del()" is done
> twice for nothing. Where do you see any breakage ?

Calling list_del() on a list item that is not on a list causes undefined 
behavior, which can result in memory corruption, segfaults, etc...