summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSantosh Shilimkar <santosh.shilimkar@ti.com>2009-04-23 11:10:40 -0700
committerTony Lindgren <tony@atomide.com>2009-04-23 11:10:40 -0700
commitda1b94e6a68e1bdeb9cdda016cceb17228b37d25 (patch)
tree2c405438f9f296d15470382c00d4d00b4c42891a
parent091069740304c979f957ceacec39c461d0192158 (diff)
downloadblackbird-op-linux-da1b94e6a68e1bdeb9cdda016cceb17228b37d25.tar.gz
blackbird-op-linux-da1b94e6a68e1bdeb9cdda016cceb17228b37d25.zip
ARM: OMAP: Fix for possible race condition in omap_free_dma()
Fix the possible race condition in omap_free_dma(). Function omap_free_dma() sets the dev_id = -1 and then accesses the channel afterwards to clear it. But setting the dev_id=-1 makes the channel available for allocation again. So it is possible someone else can grab it and results are unpredictable. To avod this DMA channle is cleared first and then the dev_id = -1 is set. Thanks to McNeil, Sean <sean.mcneil@ti.com> for ointing out this issue. Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com> Signed-off-by: Tony Lindgren <tony@atomide.com>
-rw-r--r--arch/arm/plat-omap/dma.c13
1 files changed, 6 insertions, 7 deletions
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index 21cc0142b97a..7fc8c045ad5d 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -760,19 +760,12 @@ void omap_free_dma(int lch)
{
unsigned long flags;
- spin_lock_irqsave(&dma_chan_lock, flags);
if (dma_chan[lch].dev_id == -1) {
pr_err("omap_dma: trying to free unallocated DMA channel %d\n",
lch);
- spin_unlock_irqrestore(&dma_chan_lock, flags);
return;
}
- dma_chan[lch].dev_id = -1;
- dma_chan[lch].next_lch = -1;
- dma_chan[lch].callback = NULL;
- spin_unlock_irqrestore(&dma_chan_lock, flags);
-
if (cpu_class_is_omap1()) {
/* Disable all DMA interrupts for the channel. */
dma_write(0, CICR(lch));
@@ -798,6 +791,12 @@ void omap_free_dma(int lch)
dma_write(0, CCR(lch));
omap_clear_dma(lch);
}
+
+ spin_lock_irqsave(&dma_chan_lock, flags);
+ dma_chan[lch].dev_id = -1;
+ dma_chan[lch].next_lch = -1;
+ dma_chan[lch].callback = NULL;
+ spin_unlock_irqrestore(&dma_chan_lock, flags);
}
EXPORT_SYMBOL(omap_free_dma);
OpenPOWER on IntegriCloud