From nobody Sat Jun 13 03:30:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A0BA3624CE; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; cv=none; b=vBNNxvJNPhrnnGon5lSJG97L7OWUeoK1lRrA0HvJ9i2i/n+u6QXIe21gpt0QP4ZGNNeEoA8JACgTaS8U1Fr3Izu9ntGOpP3jRW/M7wGJJ51Vs9TqlAMDx+/iasAHd8EcB4/dWuCEkRwI06qkPDJGoN7shMSge0toZirtxlpkvkE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; c=relaxed/simple; bh=OJvd+yu2zNHcgfCd9EUwx6/y6bbay/vdg2F/eE+2ajQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=A8cB8WvRfLpgy0zyPIbHyrLnavriJwRgqgjKMc9HjPsATNAVvdUPg1gCdazobDvzf668mZfnECmUBCROjOXYrxt7BUQYnO7ywhcQivWcN/WNpwQvszsKANAFysm0pNJgrMha4tGDvqeFshyG6HkkIr5M0o+CYMVzqv4ttPPG178= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=pzX7erb5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="pzX7erb5" Received: by smtp.kernel.org (Postfix) with ESMTPS id 005F0C2BCB4; Fri, 24 Apr 2026 17:39:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777052364; bh=OJvd+yu2zNHcgfCd9EUwx6/y6bbay/vdg2F/eE+2ajQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=pzX7erb5ARnTZahJ2Rooyfi+qVjydekuVa4AaGYiM7vSPm8xDDURWsPmEMKXtmn0U RYxIuQdKXa974/Xxx70/Y5kffyt72WggyjeouLVlXSWIpQgm7Avo8pFWl9jgFB0cQz hAAcM3l0wGo6fBd24iWXnftyEgWB6CoPPMecFemNfyySBp/7OPKvgeMPAXtIx6fZJK RVAruZJIwA2IJh1QVDNpw7gAe4LOj7jn3wva2Kz0bfH/bV+RMJOjsM8HUfaHTuGmFM IcDixnl3Xz0hCuMDPHUwkA9n33uVoWp6AsthcS8XDClSBROfrPRoI0tGBuWfjVhaN4 JyEbfA+y4Aejg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E88DFFED3F5; Fri, 24 Apr 2026 17:39:23 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Fri, 24 Apr 2026 18:40:14 +0100 Subject: [PATCH v4 1/4] dmaengine: Fix possible use after free Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260424-dma-dmac-handle-vunmap-v4-1-90f43412fdc0@analog.com> References: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> In-Reply-To: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1777052415; l=1250; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=J8FQACGd3OeySCyq4xc/4O/tuVwcfMAzSY7wby2Naks=; b=H17/8Zb+644xB77ycJ5potIObMnRnYyuLvr7PBnDpo3PvOfGkHcoaRNSRuwzwQ2Tn8s8zZbRd KuOTEA3ypmOCn6oQUmiqdfkToJ307HXTxnkpo92fXlVzotmAkBiZefo X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check. Fixes: 0f571515c332 ("dmaengine: Add privatecnt to revert DMA_PRIVATE prope= rty") Signed-off-by: Nuno S=C3=A1 Reviewed-by: Frank Li --- drivers/dma/dmaengine.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 405bd2fbb4a3..9049171df857 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -905,11 +905,12 @@ void dma_release_channel(struct dma_chan *chan) mutex_lock(&dma_list_mutex); WARN_ONCE(chan->client_count !=3D 1, "chan reference count %d !=3D 1\n", chan->client_count); - dma_chan_put(chan); /* drop PRIVATE cap enabled by __dma_request_channel() */ if (--chan->device->privatecnt =3D=3D 0) dma_cap_clear(DMA_PRIVATE, chan->device->cap_mask); =20 + dma_chan_put(chan); + if (chan->slave) { sysfs_remove_link(&chan->dev->device.kobj, DMA_SLAVE_NAME); sysfs_remove_link(&chan->slave->kobj, chan->name); --=20 2.54.0 From nobody Sat Jun 13 03:30:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 39A18346760; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; cv=none; b=OQT+bW//0Go7+Nl29RvD5qqMNo3uf71phLcvvxCh2026ofW8OIqmKRYp+N9SBav1y0csTKxxwGHYwbDSjYS5D6w66wlZfQQZvovpZ3xuuTTrhDWjIvz2gJrQrDUcvck77FxWRgbPuLQG/unbJ16uzMQOQCzpBFBolr4Uz1TKTcY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; c=relaxed/simple; bh=cDLJpFn92CqJTxMH9bk80u6JF/HxsNTgQn9D8LmRdGY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ajl9eNRJBxxVbMJTbWoMD/4TDCEIorw2HEOKQeBZ8ND9qLesTQ5mlENt1cKmKXpAAkhmdEX9qNNDgrqAyHjG8MOh8EG3abywUWnvUYG955UABXqn4RJtn5XB8CvN6+xz9URzNGFIVrPjG04RHb/U60QMe1ElOm3cxCNMfI7gDSY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XQG+t0wZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XQG+t0wZ" Received: by smtp.kernel.org (Postfix) with ESMTPS id 0C73FC2BCB0; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777052364; bh=cDLJpFn92CqJTxMH9bk80u6JF/HxsNTgQn9D8LmRdGY=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=XQG+t0wZoNccYos5sPAvALZBFs3h0mQLyNDpXVSYm1BJh2T89DomHSqq83Hdyha3l HQeWs0G9GEbU/XozNTI6Tjf4JArn8B2g3jpshSKB0L8nPPiWAFyjtnFnqc5piEFIGC dCPrRATkcui+pGmrg7XPm/z0Bw7Tw64nEF0S+JMj7Eyf1yYQidv835AeZ9mLr0yRJ4 019zKoQMm3lcXcZClkAPnR4DRCtyuF10kb+F+iJddxsMulhPeYpHevKqqyPLHI1hIX wRdZunJHhGXn+Y3yR3Hgs/p+IhgHlb9VBWtii4dFE+wmf+f98ff8xqOG/87vCJdyX3 tL2czIAiuFH7A== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 030B6FED3F2; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Fri, 24 Apr 2026 18:40:15 +0100 Subject: [PATCH v4 2/4] dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260424-dma-dmac-handle-vunmap-v4-2-90f43412fdc0@analog.com> References: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> In-Reply-To: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1777052415; l=874; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=B1ajbF20z574tNU6MkzXpQc/3VcoJk7X7LFl6JpZA+I=; b=Nk9EiMQtLm+6ZmUJeNmaI3JuixJVaUoxMeiVYrFhwKSQYe3C2gni+dEN3JcG95uWAB3gjCA9J WOoISnGYxZvCdaqLeUPLRAHdgDXo3hK+nH4urVI2lns7ilca1aBM9n3 X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 Use axi_dmac_free_desc() to free fully the descriptor at fail path when call axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec(). Fixes: 74609e568670 ("dmaengine: dma-axi-dmac: Implement device_prep_periph= eral_dma_vec") Signed-off-by: Nuno S=C3=A1 Reviewed-by: Frank Li --- drivers/dma/dma-axi-dmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 45c2c8e4bc45..127c3cf80a0e 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -769,7 +769,7 @@ axi_dmac_prep_peripheral_dma_vec(struct dma_chan *c, co= nst struct dma_vec *vecs, for (i =3D 0; i < nb; i++) { if (!axi_dmac_check_addr(chan, vecs[i].addr) || !axi_dmac_check_len(chan, vecs[i].len)) { - kfree(desc); + axi_dmac_free_desc(desc); return NULL; } =20 --=20 2.54.0 From nobody Sat Jun 13 03:30:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A5C93CF04A; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; cv=none; b=H/14qEd26b6q3k86bM9VEVN9pjmyo81d313z8TluGslQT2a/8KwpaAX9yUVaUnMtc9fc5aobAG62ekp8hjSyHsro5mnhUK/Pywo7EodSW3495qBXoLv3i5j58OK1nojTSvKZQW2nH0n5ytwWXwe3ZyP1yNWOg3ALIbuOkwd1Q5s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; c=relaxed/simple; bh=ATIsTMqdeRfyKk2ZBacXgt30GuntU9GUOCjTQBtcVsI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=T2yl0cuDKj/IdgQjRvxVxeZhNqlRyngoeIAWlPvlGlpOdvE9bNlxxA7fYwORI3ON+fl2vdulfVAzcByHO2Msc+87rzWpjZS8vehabABJIqfxyAYM+dxYLtsldBlGH7ksOymZpjexeO9OBV75SgcFBu/PmHNGT8rckB7/C6dXQIk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kOO4rcZl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kOO4rcZl" Received: by smtp.kernel.org (Postfix) with ESMTPS id 25C85C4AF0B; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777052364; bh=ATIsTMqdeRfyKk2ZBacXgt30GuntU9GUOCjTQBtcVsI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=kOO4rcZlI3mjL1o4NYci4VUESvXxAKFc/tRE7sHU9J1MjJ68TLsXgS3XT4sBGSB/p Io7jL2RiEYTiqCQRUExSn/yN5CVpyKpRzqEm/asqcBHfZdXUE+nC+iQj09aoSR3AaL Dyx9CFF2NZyyoYWlWkkgzoIQRKmP26QwO8ezI25zMIhLiA+aWtzzNG1xGlRVjfOqAZ W6PFDQ+CuBB1k4m0JQg1zo+eQ32svXJ97xmexjEMBAfiuAZvDQRU0HhWiYw3SklT4j f5bYe+lhx2Gp3idQq6IWBDAZcXBc2j0SfEKwdl+0mN5bYbPNiIMmCDK+eKbgdb6qM3 OXTGCx/hl/HKg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 119E6FED3F8; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Fri, 24 Apr 2026 18:40:16 +0100 Subject: [PATCH v4 3/4] dmaengine: dma-axi-dmac: Drop struct clk from main struct Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260424-dma-dmac-handle-vunmap-v4-3-90f43412fdc0@analog.com> References: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> In-Reply-To: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1777052415; l=1284; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=avj+T9/jVLfgsfiQ0Hqoh1jSjrsgZ56l2nwqP+AgXzg=; b=fSwwqjk8vDZtsatGLIsHto8HKM7xiaTE7tEO55lTxXvgcvgnhSVuZaaAUw2Wu/RaNhHloD+Hw 1m0yOEazeO3DON0nTtKgvVVzeX6yt6+vzFKT2mKIj33Yrsh61qfKtgk X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 There's no reason to keep struct clk in struct axi_dmac. Hence, use a local clk variable in .probe() and drop it from struct axi_dmac. Signed-off-by: Nuno S=C3=A1 Reviewed-by: Frank Li --- drivers/dma/dma-axi-dmac.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 127c3cf80a0e..41898d594be7 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -170,8 +170,6 @@ struct axi_dmac { void __iomem *base; int irq; =20 - struct clk *clk; - struct dma_device dma_dev; struct axi_dmac_chan chan; }; @@ -1198,6 +1196,7 @@ static int axi_dmac_probe(struct platform_device *pde= v) { struct dma_device *dma_dev; struct axi_dmac *dmac; + struct clk *clk; struct regmap *regmap; unsigned int version; u32 irq_mask =3D 0; @@ -1217,9 +1216,9 @@ static int axi_dmac_probe(struct platform_device *pde= v) if (IS_ERR(dmac->base)) return PTR_ERR(dmac->base); =20 - dmac->clk =3D devm_clk_get_enabled(&pdev->dev, NULL); - if (IS_ERR(dmac->clk)) - return PTR_ERR(dmac->clk); + clk =3D devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); =20 version =3D axi_dmac_read(dmac, ADI_AXI_REG_VERSION); =20 --=20 2.54.0 From nobody Sat Jun 13 03:30:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A5373AD510; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; cv=none; b=PV54k3yXCa83pVaUI5E9hNFA88K8aw6jH6dmeKMc/Y6TF9avOnphGewQNFClTdw8KUkVsyqZzw4YzpujdKSGf+LgoCxAK/LnCAjNIJFQ5eBtRWSKY3yy0hpwWrxLPLjKKAEtUa0yKKqPCbKs/zcijMyJrtukHo49omGrB+B55rE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777052364; c=relaxed/simple; bh=5n0eTKt2Cl626iyJU0lxSbAm30fR29gcRRZy0D1Bo6Y=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=gI/ZyjO5IBZFdOVgRAA0ND5uMuVRkS1z6hoAGFGps6W/gtTUxiCuQnmdE2c4YURaSjZgZiRufMgOpmBitwlRuuXjsFZlbdYKHchs5g1dLK2//jKZgjuT/WmPbmO1QVFNVKaHWah/ODcwqTsZzyHt+Rlrb7b4J75tLemm4n+JoDs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KS7Mpja0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KS7Mpja0" Received: by smtp.kernel.org (Postfix) with ESMTPS id 27EA7C4AF0C; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777052364; bh=5n0eTKt2Cl626iyJU0lxSbAm30fR29gcRRZy0D1Bo6Y=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=KS7Mpja0XMIk3zBoxWxFgCX28C4an6iS0f6KkS0UYooRXbb5XHP+QBXtlIBbKikdW d7so4QcW9VE5k7uZ7vVmbcznA6ndzoacJvgVB4yGc1ec2KcD4zkl7WJEyjuFSGWNpQ 0cmP836xqWajKDPRX8Sw5I6JPys8oNH4TdY6qsvdOXthGFNK5LwMasf4xo1PmCe/lh rBvKw9/kktW0FaVAnv3ToXV8F4jhe8WQ4RRGHYie/+v1wJHVB0BsyQB8BuPjq6lC/O U15E6DKjQr/Fcjq0CCvq9j32R0go4Wr2X0GK3R0+PV97nLpGv8eM8gUh8JR1S+il5C WhQCuMsegpyjA== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 206D4FED3F6; Fri, 24 Apr 2026 17:39:24 +0000 (UTC) From: =?utf-8?q?Nuno_S=C3=A1_via_B4_Relay?= Date: Fri, 24 Apr 2026 18:40:17 +0100 Subject: [PATCH v4 4/4] dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260424-dma-dmac-handle-vunmap-v4-4-90f43412fdc0@analog.com> References: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> In-Reply-To: <20260424-dma-dmac-handle-vunmap-v4-0-90f43412fdc0@analog.com> To: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Lars-Peter Clausen , Vinod Koul , Frank Li X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1777052415; l=5323; i=nuno.sa@analog.com; s=20231116; h=from:subject:message-id; bh=HqWNkCDI0VfeVEb5KKgxsi/P7bet+YEciX6Acpcld7Q=; b=zl7ajjc9sDfmd7eFj4L/AZLliMugd/RhFG9WpDr23VCMGb60Mi96x70gRoUaX5rapp93fPBEi A7DeYvKWXMEDxZGKSGhHVLKaKPD472buAM/tUPoTJ3pJ9f7cqph8lYP X-Developer-Key: i=nuno.sa@analog.com; a=ed25519; pk=3NQwYA013OUYZsmDFBf8rmyyr5iQlxV/9H4/Df83o1E= X-Endpoint-Received: by B4 Relay for nuno.sa@analog.com/20231116 with auth_id=100 X-Original-From: =?utf-8?q?Nuno_S=C3=A1?= Reply-To: nuno.sa@analog.com From: Nuno S=C3=A1 For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and hence vmalloc()) some memory. This became visible in a design where dma_direct_use_pool() is not possible. With the above, when calling dma_free_coherent(), vunmap() would be called from softirq context and thus leading to a BUG(). To fix it, use a dma pool that is allocated in .device_alloc_chan_resources() and allocate blocks from it. The key point is that now dma_pool_free() is used in axi_dmac_free_desc() to free the blocks and that just frees the blocks from the pool in the sense they can be used again. In other words, no actual call to dma_free_coherent() happens. That only happens when destroying the pool in axi_dmac_free_chan_resources() which does not happen in any interrupt context. Fixes: 3f8fd25936ee ("dmaengine: axi-dmac: Allocate hardware descriptors") Signed-off-by: Nuno S=C3=A1 Reviewed-by: Frank Li --- drivers/dma/dma-axi-dmac.c | 66 ++++++++++++++++++++++++++++--------------= ---- 1 file changed, 40 insertions(+), 26 deletions(-) diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c index 41898d594be7..d47ff27e1408 100644 --- a/drivers/dma/dma-axi-dmac.c +++ b/drivers/dma/dma-axi-dmac.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -147,6 +148,7 @@ struct axi_dmac_chan { struct virt_dma_chan vchan; =20 struct axi_dmac_desc *next_desc; + void *pool; struct list_head active_descs; enum dma_transfer_direction direction; =20 @@ -648,11 +650,17 @@ static void axi_dmac_issue_pending(struct dma_chan *c) spin_unlock_irqrestore(&chan->vchan.lock, flags); } =20 +static void axi_dmac_free_desc(struct axi_dmac_desc *desc) +{ + for (unsigned int i =3D 0; i < desc->num_sgs; i++) + dma_pool_free(desc->chan->pool, desc->sg[i].hw, desc->sg[i].hw_phys); + + kfree(desc); +} + static struct axi_dmac_desc * axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsigned int num_sgs) { - struct axi_dmac *dmac =3D chan_to_axi_dmac(chan); - struct device *dev =3D dmac->dma_dev.dev; struct axi_dmac_hw_desc *hws; struct axi_dmac_desc *desc; dma_addr_t hw_phys; @@ -664,22 +672,22 @@ axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsig= ned int num_sgs) desc->num_sgs =3D num_sgs; desc->chan =3D chan; =20 - hws =3D dma_alloc_coherent(dev, PAGE_ALIGN(num_sgs * sizeof(*hws)), - &hw_phys, GFP_ATOMIC); - if (!hws) { - kfree(desc); - return NULL; - } - for (i =3D 0; i < num_sgs; i++) { - desc->sg[i].hw =3D &hws[i]; - desc->sg[i].hw_phys =3D hw_phys + i * sizeof(*hws); + hws =3D dma_pool_zalloc(chan->pool, GFP_NOWAIT, &hw_phys); + if (!hws) { + desc->num_sgs =3D i; + axi_dmac_free_desc(desc); + return NULL; + } =20 - hws[i].id =3D AXI_DMAC_SG_UNUSED; - hws[i].flags =3D 0; + desc->sg[i].hw =3D hws; + desc->sg[i].hw_phys =3D hw_phys; + + hws->id =3D AXI_DMAC_SG_UNUSED; =20 /* Link hardware descriptors */ - hws[i].next_sg_addr =3D hw_phys + (i + 1) * sizeof(*hws); + if (i) + desc->sg[i - 1].hw->next_sg_addr =3D hw_phys; } =20 /* The last hardware descriptor will trigger an interrupt */ @@ -688,18 +696,6 @@ axi_dmac_alloc_desc(struct axi_dmac_chan *chan, unsign= ed int num_sgs) return desc; } =20 -static void axi_dmac_free_desc(struct axi_dmac_desc *desc) -{ - struct axi_dmac *dmac =3D chan_to_axi_dmac(desc->chan); - struct device *dev =3D dmac->dma_dev.dev; - struct axi_dmac_hw_desc *hw =3D desc->sg[0].hw; - dma_addr_t hw_phys =3D desc->sg[0].hw_phys; - - dma_free_coherent(dev, PAGE_ALIGN(desc->num_sgs * sizeof(*hw)), - hw, hw_phys); - kfree(desc); -} - static struct axi_dmac_sg *axi_dmac_fill_linear_sg(struct axi_dmac_chan *c= han, enum dma_transfer_direction direction, dma_addr_t addr, unsigned int num_periods, unsigned int period_len, @@ -933,9 +929,26 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_i= nterleaved( return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); } =20 +static int axi_dmac_alloc_chan_resources(struct dma_chan *c) +{ + struct axi_dmac_chan *chan =3D to_axi_dmac_chan(c); + struct device *dev =3D c->device->dev; + + chan->pool =3D dma_pool_create(dev_name(dev), dev, + sizeof(struct axi_dmac_hw_desc), + __alignof__(struct axi_dmac_hw_desc), 0); + if (!chan->pool) + return -ENOMEM; + + return 0; +} + static void axi_dmac_free_chan_resources(struct dma_chan *c) { + struct axi_dmac_chan *chan =3D to_axi_dmac_chan(c); + vchan_free_chan_resources(to_virt_chan(c)); + dma_pool_destroy(chan->pool); } =20 static void axi_dmac_desc_free(struct virt_dma_desc *vdesc) @@ -1238,6 +1251,7 @@ static int axi_dmac_probe(struct platform_device *pde= v) dma_cap_set(DMA_SLAVE, dma_dev->cap_mask); dma_cap_set(DMA_CYCLIC, dma_dev->cap_mask); dma_cap_set(DMA_INTERLEAVE, dma_dev->cap_mask); + dma_dev->device_alloc_chan_resources =3D axi_dmac_alloc_chan_resources; dma_dev->device_free_chan_resources =3D axi_dmac_free_chan_resources; dma_dev->device_tx_status =3D dma_cookie_status; dma_dev->device_issue_pending =3D axi_dmac_issue_pending; --=20 2.54.0