Commit 0b030f54 authored by Dave Jiang's avatar Dave Jiang Committed by Vinod Koul
Browse files

dmaengine: idxd: make submit failure path consistent on desc freeing 



The submission path for dmaengine API does not do descriptor freeing on
failure. Also, with the abort mechanism, the freeing of descriptor happens
when the abort callback is completed. Therefore free descriptor on all
error paths for submission call to make things consistent. Also remove the
double free that would happen on abort in idxd_dma_tx_submit() call.

Fixes: 6b4b87f2 ("dmaengine: idxd: fix submission race window")
Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/162827146072.3459011.10255348500504659810.stgit@djiang5-desk3.ch.intel.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent 9760383b

drivers/dma/idxd/dma.c

+1 −3
Original line number Diff line number Diff line
@@ -149,10 +149,8 @@ static dma_cookie_t idxd_dma_tx_submit(struct dma_async_tx_descriptor *tx) 
	cookie = dma_cookie_assign(tx);



	rc = idxd_submit_desc(wq, desc);

	if (rc < 0) {

		idxd_free_desc(wq, desc);

	if (rc < 0)

		return rc;

	}



	return cookie;

}

drivers/dma/idxd/submit.c

+9 −2
Original line number Diff line number Diff line
@@ -139,11 +139,15 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc) 
	void __iomem *portal;

	int rc;



	if (idxd->state != IDXD_DEV_ENABLED)

	if (idxd->state != IDXD_DEV_ENABLED) {

		idxd_free_desc(wq, desc);

		return -EIO;

	}



	if (!percpu_ref_tryget_live(&wq->wq_active))

	if (!percpu_ref_tryget_live(&wq->wq_active)) {

		idxd_free_desc(wq, desc);

		return -ENXIO;

	}



	portal = idxd_wq_portal_addr(wq);
@@ -175,8 +179,11 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc) 
		rc = enqcmds(portal, desc->hw);

		if (rc < 0) {

			percpu_ref_put(&wq->wq_active);

			/* abort operation frees the descriptor */

			if (ie)

				llist_abort_desc(wq, ie, desc);

			else

				idxd_free_desc(wq, desc);

			return rc;

		}

	}