[PATCH 1/1] Fix NULL pointer dereference in imx serial driver DMA callback

[Fabien Lahoudere]

From: Hannu Koivisto <hannu.koivisto@xxxxxxxxx>

dma_rx_callback() may see NULL dma_chan_rx if DMA interrupt [1] occurs a
moment[2] before imx_uart_dma_exit() sets it to NULL.  imx_uart_dma_exit()
calls dmaengine_terminate_all() and dma_release_channel() but neither of
those prevent the callback being called after they have returned. A similar
problem has been discussed by ALSA developers
(http://mailman.alsa-project.org/pipermail/alsa-devel/2013-October/067239.html)
and it was pointed out that dmaengine_terminate_all() might be called from
the callback, so we cannot call tasklet_kill() in imx-sdma's code called by
dmaengine_terminate_all().

Hopefully it doesn't make sense to call dma_release_channel() from the
callback, so instead of adding synchronization to imx serial driver, we add
tasklet_kill() call to sdma_free_chan_resources().  While most DMA drivers
don't do that, there is one example that does: pl330.

[1] It schedules sdma_tasklet, which again calls the dma_rx_callback.
[2] I tested this by scheduling the sdma tasklet as far as right before the
imx_stop_tx() call in imx_shutdown() and the problem occurred.

Signed-off-by: Fabien Lahoudere <fabien.lahoudere@xxxxxxxxxxxxxxx>
---
 drivers/dma/imx-sdma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 46c9027..da86792 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1135,6 +1135,8 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
 
 	sdma_disable_channel(chan);
 
+	tasklet_kill(&sdmac->tasklet);
+
 	if (sdmac->event_id0)
 		sdma_event_disable(sdmac, sdmac->event_id0);
 	if (sdmac->event_id1)
-- 
2.7.4