The controller tasklet can detach completed descriptors and invoke their callbacks outside the channel lock. Terminating the channel does not wait for those callbacks, and there is no device_synchronize hook. A client can therefore reuse callback state or release its buffers after dmaengine_synchronize() while an old callback still uses them. Disable and re-enable the controller tasklet from device_synchronize, outside the channel lock. Disabling waits for an executing tasklet, including descriptors it already removed from the channel lists. After termination, a later tasklet run cannot acquire another descriptor from the terminated channel. Clients must continue to exclude new submissions on that channel until synchronization finishes. The tasklet is shared, so other channels may schedule it while this wait is in progress. Preserve those pending runs: tasklet_kill() temporarily owns the scheduling bit and can consume a concurrent scheduling request, leaving controller interrupts masked. The disable/enable pair leaves the scheduling bit and pending tasklet queue intact. Other channels' hardware transfers continue, though their callbacks may be briefly deferred. Fixes: b36f09c3c441 ("dmaengine: Add transfer termination synchronization support") Reported-by: Sashiko Closes: https://lore.kernel.org/r/sashiko-outbox-180707@kernel.org Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Reviewed-by: Frank Li --- drivers/dma/dw/core.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c index 3bda85adbeee..66065d7b26ae 100644 --- a/drivers/dma/dw/core.c +++ b/drivers/dma/dw/core.c @@ -902,6 +902,19 @@ static int dwc_terminate_all(struct dma_chan *chan) return 0; } +static void dwc_synchronize(struct dma_chan *chan) +{ + struct dw_dma *dw = to_dw_dma(chan->device); + + /* + * Termination removes the channel's descriptors from the lists, but a + * running tasklet may still own a completed descriptor and its callback. + * Wait for that run without losing schedules from the other channels. + */ + tasklet_disable(&dw->tasklet); + tasklet_enable(&dw->tasklet); +} + static struct dw_desc *dwc_find_desc(struct dw_dma_chan *dwc, dma_cookie_t c) { struct dw_desc *desc; @@ -1295,6 +1308,7 @@ int do_dma_probe(struct dw_dma_chip *chip) dw->dma.device_pause = dwc_pause; dw->dma.device_resume = dwc_resume; dw->dma.device_terminate_all = dwc_terminate_all; + dw->dma.device_synchronize = dwc_synchronize; dw->dma.device_tx_status = dwc_tx_status; dw->dma.device_issue_pending = dwc_issue_pending; -- 2.53.0