Re: [PATCH v2] dmaengine: sun6i: Fix potential deadlock on sdev->lock

[Frank Li]

On Mon, Jul 06, 2026 at 11:17:21AM +0800, Hongling Zeng wrote:
> sun6i_dma_terminate_all() and sun6i_dma_pause() acquire sdev->lock
> with plain spin_lock() from process context. If a DMA interrupt fires
> on the same CPU while the lock is held, the interrupt handler schedules
> sun6i_dma_tasklet(), which runs in softirq context and attempts to
> acquire the same lock with spin_lock_irq(), causing a deadlock.
>
> Fix by using spin_lock_irq() to disable interrupts while holding
> sdev->lock, consistent with other call sites.
>
> Fixes: ba489fd46ab6 ("dmaengine: sun6i: Add support for Allwinner A31 DMA controller")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
>

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

> ---
> Change in v2:
>  -Fix by using spin_lock_irqsave() and spin_unlock_irqrestore() to
>   disable interrupts while holding sdev->lock and properly save/restore
>   interrupt state.
> ---
>  drivers/dma/sun6i-dma.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
> index a9a254dbf8cb..a6487971ad09 100644
> --- a/drivers/dma/sun6i-dma.c
> +++ b/drivers/dma/sun6i-dma.c
> @@ -891,6 +891,7 @@ static int sun6i_dma_pause(struct dma_chan *chan)
>  	struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device);
>  	struct sun6i_vchan *vchan = to_sun6i_vchan(chan);
>  	struct sun6i_pchan *pchan = vchan->phy;
> +	unsigned long flags;
>
>  	dev_dbg(chan2dev(chan), "vchan %p: pause\n", &vchan->vc);
>
> @@ -898,9 +899,9 @@ static int sun6i_dma_pause(struct dma_chan *chan)
>  		writel(DMA_CHAN_PAUSE_PAUSE,
>  		       pchan->base + DMA_CHAN_PAUSE);
>  	} else {
> -		spin_lock(&sdev->lock);
> +		spin_lock_irqsave(&sdev->lock, flags);
>  		list_del_init(&vchan->node);
> -		spin_unlock(&sdev->lock);
> +		spin_unlock_irqrestore(&sdev->lock, flags);
>  	}
>
>  	return 0;
> @@ -939,9 +940,9 @@ static int sun6i_dma_terminate_all(struct dma_chan *chan)
>  	unsigned long flags;
>  	LIST_HEAD(head);
>
> -	spin_lock(&sdev->lock);
> +	spin_lock_irqsave(&sdev->lock, flags);
>  	list_del_init(&vchan->node);
> -	spin_unlock(&sdev->lock);
> +	spin_unlock_irqrestore(&sdev->lock, flags);
>
>  	spin_lock_irqsave(&vchan->vc.lock, flags);
>
> --
> 2.25.1
>