Parcourir la source

ioat: close potential BUG_ON race in the descriptor cleanup path

Since ioat_cleanup_preamble() and the update of the last completed
descriptor are not synchronized there is a chance that two cleanup threads
can see descriptors to clean.  If the first cleans up all pending
descriptors then the second will trigger the BUG_ON.

Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Dan Williams il y a 15 ans
Parent
commit
aa75db0080
2 fichiers modifiés avec 2 ajouts et 2 suppressions
  1. 1 1
      drivers/dma/ioat/dma_v2.c
  2. 1 1
      drivers/dma/ioat/dma_v3.c

+ 1 - 1
drivers/dma/ioat/dma_v2.c

@@ -158,7 +158,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 			seen_current = true;
 	}
 	ioat->tail += i;
-	BUG_ON(!seen_current); /* no active descs have written a completion? */
+	BUG_ON(active && !seen_current); /* no active descs have written a completion? */
 
 	chan->last_completion = phys_complete;
 	if (ioat->head == ioat->tail) {

+ 1 - 1
drivers/dma/ioat/dma_v3.c

@@ -293,7 +293,7 @@ static void __cleanup(struct ioat2_dma_chan *ioat, unsigned long phys_complete)
 		}
 	}
 	ioat->tail += i;
-	BUG_ON(!seen_current); /* no active descs have written a completion? */
+	BUG_ON(active && !seen_current); /* no active descs have written a completion? */
 	chan->last_completion = phys_complete;
 	if (ioat->head == ioat->tail) {
 		dev_dbg(to_dev(chan), "%s: cancel completion timeout\n",