[PATCH v2 0/4] dmaengine: dma-axi-dmac: Some memory related fixes

Nuno Sá via B4 Relay posted 4 patches 5 days, 21 hours ago
drivers/dma/dma-axi-dmac.c | 122 ++++++++++++++++++++++++++++++++++++---------
drivers/dma/dmaengine.c    |   3 +-
2 files changed, 100 insertions(+), 25 deletions(-)
[PATCH v2 0/4] dmaengine: dma-axi-dmac: Some memory related fixes
Posted by Nuno Sá via B4 Relay 5 days, 21 hours ago
Ok, I rushed into v2 because I saw (based on AI review) that I already
had some fundamental issues. Some fairly straight (a bit embarrassing tbh)
but others not so much. Another thing to notice is that I changed the
order between "fix use-after-free on unbind" and "Defer freeing DMA
descriptors" because it just makes more sense given that using the
worker only works 100% if we don't have our DMA object bounded with the
platform driver.

Anyways, more details on the changelog.

Also note the addition of two new patches. The dmaengine one seems legit
but I want to note it was just by code inspection.

Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
Changes in v2:
- Patch 1:
  * New patch.
- Patch 2:
  * New patch.
- Patch 3:
  * Use __free() to allocate the ojject so we don't leak in early
    errors. Note that after dmaenginem_async_device_register(), the
    object lifetime is handled by dmaengine;
  * Move get_device() to after registering the device;
  * Still allow to free DMA descriptors in axi_dmac_terminate_all();
  * Use spin_lock_irqsave() to avoid possible deadlocks. 
  * Include spinlock.h
- Patch 4:
  * Include workqueue.h;
  * Save struct device directly in struct axi_dmac_desc and get a
    reference when allocating. Give the reference when freeing the
    descriptor.
- Link to v1: https://patch.msgid.link/20260326-dma-dmac-handle-vunmap-v1-0-be3e46ffaf69@analog.com

---
Eliza Balas (1):
      dmaengine: dma-axi-dmac: Defer freeing DMA descriptors

Nuno Sá (3):
      dmaengine: Fix possuible use after free
      dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
      dmaengine: dma-axi-dmac: fix use-after-free on unbind

 drivers/dma/dma-axi-dmac.c | 122 ++++++++++++++++++++++++++++++++++++---------
 drivers/dma/dmaengine.c    |   3 +-
 2 files changed, 100 insertions(+), 25 deletions(-)
---
base-commit: b7560798466a07d9c3fb011698e92c335ab28baf
change-id: 20260325-dma-dmac-handle-vunmap-84a06df7d133
--

Thanks!
- Nuno Sá