From nobody Mon Jun 15 06:29:58 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 552083C4572; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; cv=none; b=GqSju7c4t3Jv5PRAnDZYZIbk97cWy5MQ8kGDYt6nFsoPC6ZqJsP+xj3K60ZiHuX0WYyWNV2VcwaRvYAwOwmBlwBFnUaMy1UlBYTaptT2bTqQJUP5P9pf+6YlevDnXWeNHnYPqdOz6wjVplDJ5f/jV5mqyW/TRZ1/LsKHZJ9zUFE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; c=relaxed/simple; bh=tM8m65XuDlt5RZNy9a9VEBHaYpJqz9qh0EbGJHjxdUg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=np8X0GeSDrzmzZaDT9aNFnEatviNQs3/VgUeGVOFbQQq9Vq1rGS5qm/MCD9/824mRGLsZ9DgthnWSQME9q1TuSrUAV6/qZ+wsjbvL/l6AvxuQptiUloJsooBipXMHVMWInwst9Adc07Lr4uxLtLQjmPQ3xxL/jcGyi3mnjrNRJw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=uEqZsy1D; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="uEqZsy1D" Received: by smtp.kernel.org (Postfix) with ESMTPS id EB2A0C2BCAF; Wed, 8 Apr 2026 12:41:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775652112; bh=tM8m65XuDlt5RZNy9a9VEBHaYpJqz9qh0EbGJHjxdUg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=uEqZsy1D6iBY0SI0DEX43ndQO/dkztpntLR4jXZ/3MQ3PGBlbmiSqkWqxuszOSGUG eha8J1KGhYJXHomuoYLMZWw7lGWmJkKvfOq4baQEhKA7AeuW7GeY36MrNLhcK/JuTd W2L2HdmhmavX/l9DEEo898uLiZ29x1ZcqsdF+76PcrCHGzwjaOZex+vDExxuA78D7v H70Rguh0cvDqo/1CcMS0kLlGubsaOR5uVimMbz+IUPOp+0Rs6anTwwjLNkQQQVpxjR EJfusfhRNdCGW/ROruaXWMDgecHpndKPnG41yvXiA9RC/5ufgj5pKMdhlmRqoarMHY iRjGNxAZBrNtA== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D475B1073CA8; Wed, 8 Apr 2026 12:41:51 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Wed, 08 Apr 2026 13:42:40 +0100 Subject: [PATCH v3 1/4] dmaengine: Fix possible use after free Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260408-dma-dmac-handle-vunmap-v3-1-2456ad292154@analog.com> References: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> In-Reply-To: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775652161; l=1349; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=6XbKWWnu/XLY2+T0r/woFDDSj9C/H1ATZbhK/NSCskE=; b=+BZ++WfuTRR3OxUZPiujlmtxeI7Iicl4JzpuyEQ9qRfF3aMt3YU53A2ibkdNO0+ntfemOTx7o FElg/27DZC+Czle7yzEylssm6eTFQsrpr1KiVOUi9GGgVVu9IB81yvv X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 In dma_release_channel(), we first called dma_chan_put() and then checked chan->device->privatecnt for possibly clearing DMA_PRIVATE. However, dma_chan_put() will call dma_device_put() which could, potentially (if the DMA provider is already gone for example), release the last reference of the device and hence freeing the it. Fix it, by doing the check before calling dma_chan_put(). Fixes: 0f571515c332 ("dmaengine: Add privatecnt to revert DMA_PRIVATE prope= rty") Signed-off-by: Nuno S=C3=A1 --- drivers/dma/dmaengine.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 405bd2fbb4a3..9049171df857 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -905,11 +905,12 @@ void dma_release_channel(struct dma_chan *chan) mutex_lock(&dma_list_mutex); WARN_ONCE(chan->client_count !=3D 1, "chan reference count %d !=3D 1\n", chan->client_count); - dma_chan_put(chan); /* drop PRIVATE cap enabled by __dma_request_channel() */ if (--chan->device->privatecnt =3D=3D 0) dma_cap_clear(DMA_PRIVATE, chan->device->cap_mask); =20 + dma_chan_put(chan); + if (chan->slave) { sysfs_remove_link(&chan->dev->device.kobj, DMA_SLAVE_NAME); sysfs_remove_link(&chan->slave->kobj, chan->name); --=20 2.53.0 From nobody Mon Jun 15 06:29:58 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 691C33C660E; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; cv=none; b=PnYzADbGK2LUB32ZLEIb2bHaGYd53SCce0i7p7xNGy8S+IbBE7CWVru3LHDbKR/8FpZp0spKTxJ0XmwW93rS7rg91cMPe0DEMBI9RT4yfWud4F5LhlHAmI5FtGss76LUKfTMFOjAKCVLpGxT0Zz71JAEPV4gQou1xJ/SsENlRb8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; c=relaxed/simple; bh=09nJSRlAd6N1UqTYdtf9KSCV6nHMp6BK6/gYyYC5J8k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GzjZh/vj3Ivy5xeO59C+NCOJsKgp2QT5gczgBaQS/udpnaNLgtqq6+c9gO/VL4ZYHmi6WzrMs+B+CbMUjnp7OxIEAHfKUBnUlK40XSfrFKC7smFbH1ZSx4b7Cn471iOluLN3THQV5IQ5YS2EnqtjiyOmlfflbdqd69mW1koscuo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CZ92NwHp; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CZ92NwHp" Received: by smtp.kernel.org (Postfix) with ESMTPS id 01FCAC19424; Wed, 8 Apr 2026 12:41:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775652112; bh=09nJSRlAd6N1UqTYdtf9KSCV6nHMp6BK6/gYyYC5J8k=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=CZ92NwHp9kevRPMk08po5rN8gilb/coxsz11JyTia+9xFb7u/mvp3Np2qyPw5AvlH 3KP+MG0XjWN9BvVSvA1+GECtWBZ5NYBnKI7Ua2HJz3YvefRedLWHEUWaXeSHD6ihdn 7ChdmWOM7adcT9eVGWmpVEaPVd3+uQ8kSCFFUuz5WzbhGrPp38SIHTrgjnLgweILd2 ZsOsLUqOzRaTeo8cRGzG2fo6XmOY3pGDm5US9de82ZoJ95XyTkERftb4DAN38u432t BgqdRhZTIfKXdFOIgMya3Czn0gilQKQzw274hlbakunMM10IpWlq9vn0cN3W7Hw1xz 0p44QDrdlRDKQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E32951073CAB; Wed, 8 Apr 2026 12:41:51 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Wed, 08 Apr 2026 13:42:41 +0100 Subject: [PATCH v3 2/4] dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260408-dma-dmac-handle-vunmap-v3-2-2456ad292154@analog.com> References: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> In-Reply-To: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775652161; l=889; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=FiW+zvQ0Vg5geNpbllXV8K8Pu2uQGa6K1A0veJRrIZI=; b=pGZW9OUn4eE29hNeUkXDCFnvqVaFshghoo22ssxsncbZV8gPmifgJEWB2pP3dYtmhoTfbvfWh 6jj/ZNNg+fCAuUQq8AGXTtrF7iv2AT8xDl0aCLurO8uy4B2GOnlfv3y X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 In axi_dmac_prep_peripheral_dma_vec() if we fail after calling axi_dmac_alloc_desc(), we need to use axi_dmac_free_desc() to fully free the descriptor. Fixes: 74609e568670 ("dmaengine: dma-axi-dmac: Implement device_prep_periph= eral_dma_vec") Signed-off-by: Nuno S=C3=A1 --- drivers/dma/dma-axi-dmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 45c2c8e4bc45..127c3cf80a0e 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -769,7 +769,7 @@ axi_dmac_prep_peripheral_dma_vec(struct dma_chan *c, co= nst struct dma_vec *vecs, for (i =3D 0; i < nb; i++) { if (!axi_dmac_check_addr(chan, vecs[i].addr) || !axi_dmac_check_len(chan, vecs[i].len)) { - kfree(desc); + axi_dmac_free_desc(desc); return NULL; } =20 --=20 2.53.0 From nobody Mon Jun 15 06:29:58 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8529F3C73E1; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; cv=none; b=FUJHOMmMZoGvpUHbM383UWSozbz0u55GnPgsKdToRjCzZlMNZaVThItIDj4fQqRXkY6VX/eidCGcD90Im6ao2/KExgtgvcTJTneXox9GAm3XDQkekqBj2G9ZwaUrj9BTZ8j4cGkZeEFanIf3QXN1vyejeR8KqRDD+FqRSI4rCvI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; c=relaxed/simple; bh=X/lDO35rL1/Tn3k7QCVW9Udcj73gwaYAAXSPhJt5y1I=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=oHsN5E8LQapOCogSTrrs6GpOsSLHVm8Be4eKk8UAF7+OAcYp+0VzcrDIamFLeIdz+AND6Jcq6568DYwn1DB10+qQcqgJGePxBvm5/pjnIrmRwV3SZRpXdJNRvEWD++/DVRkeHEOASPA4QJBPa2mbSSwpdkkzgWTvBNvj3moNJEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CTWvMB9V; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CTWvMB9V" Received: by smtp.kernel.org (Postfix) with ESMTPS id 0EDA7C2BCB2; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775652112; bh=X/lDO35rL1/Tn3k7QCVW9Udcj73gwaYAAXSPhJt5y1I=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=CTWvMB9VJdq9Hn5HWkdVvLsRRo1iq51xez2hahtMdPTHQ0Ih1NOefxfl2cuWK2/Eo jbv7XPNZrXjlSiTAqpALyf4Csgbx8m8VB6oiv5OofCDD/kcjrWwom3geqptRz3kXbL t7lWlVVocAscJefO28P9s26JRDAVri+IDhqrRl8hvXvted5mGze16slJ92uhsqYwNi YJROnxKKy/P39ik28qzd/mGZDbWIhcF/TXEWrdc8eOGJcw+XZ60ecny0gRykqbFUpE xV8W1xi9JYM+JqN7jd/QwqpTjkBpy8J/VdUOAen2QEQmEPgdojLV9y45+7uorUd33h 8VjUkaqKAg3Cg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 012431073CAD; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Wed, 08 Apr 2026 13:42:42 +0100 Subject: [PATCH v3 3/4] dmaengine: dma-axi-dmac: Drop struct clk from main struct Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260408-dma-dmac-handle-vunmap-v3-3-2456ad292154@analog.com> References: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> In-Reply-To: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775652161; l=1271; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=QvJ5ia4JnsZhnq/kgtM2oBkAf3EjDDkcD8ZAMJui6c0=; b=VDVFL1nBPgidACu/Oxb7bKfwAFlRGTnHyQQTbmPz3w+FqQ3LJqFiZ9vT2jAI9qrJHTy0nsABH YIUgLcKB2CMD7LXdskLMQ38jX4EIoAyAfouFDwzge5o3xUbQ0hGKq68 X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 There's no reason to keep struct clk in struct axi_dmac. Hence, use a local clk variable in .probe() and be done with it. Signed-off-by: Nuno S=C3=A1 --- drivers/dma/dma-axi-dmac.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 127c3cf80a0e..41898d594be7 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -170,8 +170,6 @@ struct axi_dmac { void __iomem *base; int irq; =20 - struct clk *clk; - struct dma_device dma_dev; struct axi_dmac_chan chan; }; @@ -1198,6 +1196,7 @@ static int axi_dmac_probe(struct platform_device *pde= v) { struct dma_device *dma_dev; struct axi_dmac *dmac; + struct clk *clk; struct regmap *regmap; unsigned int version; u32 irq_mask =3D 0; @@ -1217,9 +1216,9 @@ static int axi_dmac_probe(struct platform_device *pde= v) if (IS_ERR(dmac->base)) return PTR_ERR(dmac->base); =20 - dmac->clk =3D devm_clk_get_enabled(&pdev->dev, NULL); - if (IS_ERR(dmac->clk)) - return PTR_ERR(dmac->clk); + clk =3D devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); =20 version =3D axi_dmac_read(dmac, ADI_AXI_REG_VERSION); =20 --=20 2.53.0 From nobody Mon Jun 15 06:29:58 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B79A3C6A20; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; cv=none; b=ACmHTcBzdwgrotqqv6Lzxv2zGz9723RsfYcuNPE2rNYLBUEesECNvz41A2HEosinDBfgGBJkXB0XBGFKHniAaL2vEp+DRFoKpF4rTxjXBUE4+VHSuqnSRZIVG2ii6NPsl9EKUGWeI6a9n8xggMig4H58FjGsPQaJ/vqRumEMqtw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775652112; c=relaxed/simple; bh=ROtjIbpyDk96T8F2lSYYl+HG6LSKvrDvDMFfMYQBlzY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uJj6RxYM5FZxBi4JKZJU40iPEGBxlF74kS+YHZY8MAorjfJAR8BFCYOmnvyw9d8vZ9t9KA7n2Z/Wg1vo2q8NNh6VOxkAVqdYK32MmMpi26eJSZ28s0+unXdy226fbY7orDPIN5HOW9hKTlJjEj9pI2cTtgqT/2LORbzzAb+Df3o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SenShctZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SenShctZ" Received: by smtp.kernel.org (Postfix) with ESMTPS id 1A850C2BCB3; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775652112; bh=ROtjIbpyDk96T8F2lSYYl+HG6LSKvrDvDMFfMYQBlzY=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=SenShctZCFI+iZShB7HP4Jo/1XHOh/Stfz+hZvZjPxHJvv0zTb3+BgYJbAkdR79PO ua/Vp7CP4/YiBFfHcqj+fnMf5qjxUqT6+jVkoHLZxIGe+xKe5gXW8+6z1izTi8aZN2 dPV6YpyZMTdAdqUUPMmLjfDNp3ypvARvj3Kelw9q7Emf8r8DVpHPn7oOtNHTQtuR7N Z5xGqvCt0cLFFvCs5xFLetUN1iCgYNFE9EhsMPKXHmZcGqQMKwea5rt+SKwecGCvXX 01UhosLE2zGK5RI5QElIilwdLpCWQnLAATvYjPEYuAPgD/XT9AlwbTwTiZLdAlZ5Eh rWGSwSpKv2Kyw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 129C31073C93; Wed, 8 Apr 2026 12:41:52 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Wed, 08 Apr 2026 13:42:43 +0100 Subject: [PATCH v3 4/4] dmaengine: dma-axi-dmac: Fig BUG() on vunmap() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260408-dma-dmac-handle-vunmap-v3-4-2456ad292154@analog.com> References: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> In-Reply-To: <20260408-dma-dmac-handle-vunmap-v3-0-2456ad292154@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.1 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775652161; l=5247; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=KzDfaSnPpvy2D4wxKHW5ARqGw5aBbUaqGy+f36zi13Q=; b=thtB8sL05Q+PPK2j5gKDK5pSKysY9PnifHL08IQNkK48BKw/xnH8YOsi3efQhsWzJOrFEEMqS LauzH44E5UGDBV3H6MVzt8hKwA0+UhFqhzK1RsTfP+BA8RTTCQJW+WL X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and hence vmalloc()) some memory. This became visible in a design where dma_direct_use_pool() is not possible. With the above, when calling dma_free_coherent(), vunmap() would be called from softirq context and thus leading to a BUG(). To fix it, use a dma pool that is allocated in .device_alloc_chan_resources() and allocate blocks from it. The key point is that now dma_pool_free() is used in axi_dmac_free_desc() to free the blocks and that just frees the blocks from the pool in the sense they can be used again. In other words, no actual call to dma_free_coherent() happens. That only happens when destroying the pool in axi_dmac_free_chan_resources() which does not happen in any interrupt context. Signed-off-by: Nuno S=C3=A1 --- drivers/dma/dma-axi-dmac.c | 66 ++++++++++++++++++++++++++++--------------= ---- 1 file changed, 40 insertions(+), 26 deletions(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 41898d594be7..d47ff27e1408 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -147,6 +148,7 @@ struct axi_dmac_chan { struct virt_dma_chan vchan; =20 struct axi_dmac_desc *next_desc; + void *pool; struct list_head active_descs; enum dma_transfer_direction direction; =20 @@ -648,11 +650,17 @@ static void axi_dmac_issue_pending(struct dma_chan *c) spin_unlock_irqrestore(&chan->vchan.lock, flags); } =20 +static void axi_dmac_free_desc(struct axi_dmac_desc *desc) +{ + for (unsigned int i =3D 0; i < desc->num_sgs; i++) + dma_pool_free(desc->chan->pool, desc->sg[i].hw, desc->sg[i].hw_phys); + + kfree(desc); +} + static struct axi_dmac_desc * axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsigned int num_sgs) { - struct axi_dmac *dmac =3D chan_to_axi_dmac(chan); - struct device *dev =3D dmac->dma_dev.dev; struct axi_dmac_hw_desc *hws; struct axi_dmac_desc *desc; dma_addr_t hw_phys; @@ -664,22 +672,22 @@ axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsig= ned int num_sgs) desc->num_sgs =3D num_sgs; desc->chan =3D chan; =20 - hws =3D dma_alloc_coherent(dev, PAGE_ALIGN(num_sgs * sizeof(*hws)), - &hw_phys, GFP_ATOMIC); - if (!hws) { - kfree(desc); - return NULL; - } - for (i =3D 0; i < num_sgs; i++) { - desc->sg[i].hw =3D &hws[i]; - desc->sg[i].hw_phys =3D hw_phys + i * sizeof(*hws); + hws =3D dma_pool_zalloc(chan->pool, GFP_NOWAIT, &hw_phys); + if (!hws) { + desc->num_sgs =3D i; + axi_dmac_free_desc(desc); + return NULL; + } =20 - hws[i].id =3D AXI_DMAC_SG_UNUSED; - hws[i].flags =3D 0; + desc->sg[i].hw =3D hws; + desc->sg[i].hw_phys =3D hw_phys; + + hws->id =3D AXI_DMAC_SG_UNUSED; =20 /* Link hardware descriptors */ - hws[i].next_sg_addr =3D hw_phys + (i + 1) * sizeof(*hws); + if (i) + desc->sg[i - 1].hw->next_sg_addr =3D hw_phys; } =20 /* The last hardware descriptor will trigger an interrupt */ @@ -688,18 +696,6 @@ axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsign= ed int num_sgs) return desc; } =20 -static void axi_dmac_free_desc(struct axi_dmac_desc *desc) -{ - struct axi_dmac *dmac =3D chan_to_axi_dmac(desc->chan); - struct device *dev =3D dmac->dma_dev.dev; - struct axi_dmac_hw_desc *hw =3D desc->sg[0].hw; - dma_addr_t hw_phys =3D desc->sg[0].hw_phys; - - dma_free_coherent(dev, PAGE_ALIGN(desc->num_sgs * sizeof(*hw)), - hw, hw_phys); - kfree(desc); -} - static struct axi_dmac_sg *axi_dmac_fill_linear_sg(struct axi_dmac_chan *c= han, enum dma_transfer_direction direction, dma_addr_t addr, unsigned int num_periods, unsigned int period_len, @@ -933,9 +929,26 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_i= nterleaved( return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); } =20 +static int axi_dmac_alloc_chan_resources(struct dma_chan *c) +{ + struct axi_dmac_chan *chan =3D to_axi_dmac_chan(c); + struct device *dev =3D c->device->dev; + + chan->pool =3D dma_pool_create(dev_name(dev), dev, + sizeof(struct axi_dmac_hw_desc), + __alignof__(struct axi_dmac_hw_desc), 0); + if (!chan->pool) + return -ENOMEM; + + return 0; +} + static void axi_dmac_free_chan_resources(struct dma_chan *c) { + struct axi_dmac_chan *chan =3D to_axi_dmac_chan(c); + vchan_free_chan_resources(to_virt_chan(c)); + dma_pool_destroy(chan->pool); } =20 static void axi_dmac_desc_free(struct virt_dma_desc *vdesc) @@ -1238,6 +1251,7 @@ static int axi_dmac_probe(struct platform_device *pde= v) dma_cap_set(DMA_SLAVE, dma_dev->cap_mask); dma_cap_set(DMA_CYCLIC, dma_dev->cap_mask); dma_cap_set(DMA_INTERLEAVE, dma_dev->cap_mask); + dma_dev->device_alloc_chan_resources =3D axi_dmac_alloc_chan_resources; dma_dev->device_free_chan_resources =3D axi_dmac_free_chan_resources; dma_dev->device_tx_status =3D dma_cookie_status; dma_dev->device_issue_pending =3D axi_dmac_issue_pending; --=20 2.53.0