[PATCHv3 2/6] ata: pata_mpc52xx: synchronize with task IRQ before resetting DMA state

[Rosen Penev]

mpc52xx_bmdma_stop() calls bcom_disable() to stop the BestComm task,
but an already-pending task completion IRQ can still fire and execute
mpc52xx_ata_task_irq() concurrently. The handler iterates the BD ring
via bcom_buffer_done()/bcom_retrieve_buffer() and writes to
priv->waiting_for_dma, while bmdma_stop resets the BD ring with
bcom_ata_reset_bd() and clears waiting_for_dma -- all without
synchronization.

Add a task_irq field to priv, store it during probe, and call
synchronize_irq() after bcom_disable() and before bcom_ata_reset_bd()
to ensure the handler has completed and cannot race with the BD ring
reset or the waiting_for_dma clear.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
---
 drivers/ata/pata_mpc52xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index fe445d6aaff6..72a2b677bc90 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -58,6 +58,7 @@ struct mpc52xx_ata_priv {
 
 	/* DMA */
 	struct bcom_task		*dmatsk;
+	int				task_irq;
 	const struct udmaspec		*udmaspec;
 	const struct mdmaspec		*mdmaspec;
 	int 				mpc52xx_ata_dma_last_write;
@@ -571,6 +572,7 @@ mpc52xx_bmdma_stop(struct ata_queued_cmd *qc)
 	struct mpc52xx_ata_priv *priv = ap->host->private_data;
 
 	bcom_disable(priv->dmatsk);
+	synchronize_irq(priv->task_irq);
 	bcom_ata_reset_bd(priv->dmatsk);
 	priv->waiting_for_dma = 0;
 
@@ -769,6 +771,7 @@ static int mpc52xx_ata_probe(struct platform_device *op)
 	priv->dmatsk = dmatsk;
 
 	task_irq = bcom_get_task_irq(dmatsk);
+	priv->task_irq = task_irq;
 	rv = devm_request_irq(&op->dev, task_irq, &mpc52xx_ata_task_irq, 0,
 				"ATA task", priv);
 	if (rv) {
-- 
2.54.0