[PATCH 5.15 554/570] dmaengine: sh: rz-dmac: Protect the driver specific lists

Greg Kroah-Hartman
2026-04-13T16:41:52Z

From: Claudiu Beznea <claudiu.beznea@tuxon.dev>

[ Upstream commit abb863e6213dc41a58ef8bb3289b7e77460dabf3 ]

The driver lists (ld_free, ld_queue) are used in
rz_dmac_free_chan_resources(), rz_dmac_terminate_all(),
rz_dmac_issue_pending(), and rz_dmac_irq_handler_thread(), all under
the virtual channel lock. Take the same lock in rz_dmac_prep_slave_sg()
and rz_dmac_prep_dma_memcpy() as well to avoid concurrency issues, since
these functions also check whether the lists are empty and update or
remove list entries.

Fixes: 5000d37042a6 ("dmaengine: sh: Add DMAC driver for RZ/G2L SoC")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20260316133252.240348-2-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
[ replaced scoped_guard(spinlock_irqsave) with explicit spin_lock_irqsave/spin_unlock_irqrestore calls ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/sh/rz-dmac.c | 24 ++++++++++++++++++++----
1 file changed, 20 insertions(+), 4 deletions(-)

--- a/drivers/dma/sh/rz-dmac.c
+++ b/drivers/dma/sh/rz-dmac.c
@@ -419,6 +419,7 @@ static int rz_dmac_alloc_chan_resources(
if (!desc)
break;

+ /* No need to lock. This is called only for the 1st client. */
list_add_tail(&desc->node, &channel->ld_free);
channel->descs_allocated++;
}
@@ -470,12 +471,17 @@ rz_dmac_prep_dma_memcpy(struct dma_chan
struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
struct rz_dmac *dmac = to_rz_dmac(chan->device);
struct rz_dmac_desc *desc;
+ unsigned long irqflags;

dev_dbg(dmac->dev, "%s channel: %d src=0x%pad dst=0x%pad len=%zu\n",
__func__, channel->index, &src, &dest, len);

- if (list_empty(&channel->ld_free))
+ spin_lock_irqsave(&channel->vc.lock, irqflags);
+
+ if (list_empty(&channel->ld_free)) {
+ spin_unlock_irqrestore(&channel->vc.lock, irqflags);
return NULL;
+ }

desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);

@@ -486,6 +492,9 @@ rz_dmac_prep_dma_memcpy(struct dma_chan
desc->direction = DMA_MEM_TO_MEM;

list_move_tail(channel->ld_free.next, &channel->ld_queue);
+
+ spin_unlock_irqrestore(&channel->vc.lock, irqflags);
+
return vchan_tx_prep(&channel->vc, &desc->vd, flags);
}

@@ -498,17 +507,21 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
struct rz_dmac_chan *channel = to_rz_dmac_chan(chan);
struct rz_dmac_desc *desc;
struct scatterlist *sg;
+ unsigned long irqflags;
int dma_length = 0;
int i = 0;

- if (list_empty(&channel->ld_free))
+ spin_lock_irqsave(&channel->vc.lock, irqflags);
+
+ if (list_empty(&channel->ld_free)) {
+ spin_unlock_irqrestore(&channel->vc.lock, irqflags);
return NULL;
+ }

desc = list_first_entry(&channel->ld_free, struct rz_dmac_desc, node);

- for_each_sg(sgl, sg, sg_len, i) {
+ for_each_sg(sgl, sg, sg_len, i)
dma_length += sg_dma_len(sg);
- }

desc->type = RZ_DMAC_DESC_SLAVE_SG;
desc->sg = sgl;
@@ -522,6 +535,9 @@ rz_dmac_prep_slave_sg(struct dma_chan *c
desc->dest = channel->dst_per_address;

list_move_tail(channel->ld_free.next, &channel->ld_queue);
+
+ spin_unlock_irqrestore(&channel->vc.lock, irqflags);
+
return vchan_tx_prep(&channel->vc, &desc->vd, flags);
}