From nobody Sun May 24 20:34:04 2026 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D97FB2F6911 for ; Thu, 21 May 2026 14:48:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374884; cv=none; b=sQkT0kUQDcJtYpT0rvU0XUExhLm9PGQ8hwvkAyVaFsrB2EXGDSmv27EKAsxJsOB+NweLVqXwfzYIUFRh7W7PQ9qG9IpJZcMvb6qA+ag4OOvE9dEUXuUgXu2O1kWuqwkwqdufbCi3hQQ9kbG5rG0gmFrBf5ku3LDqajAtbhlED+s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374884; c=relaxed/simple; bh=EX9iuFe2HivKCwOTaxCINsh3UzE2ULn9Ke1iwK2Idbg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ORiRmjS7ato4Xxy5W3LhUbpBp/KwJvlcy0lCyJNsC1Ll7ErsyPV5T95kLDPoG5n0bdFR1TYK6OPi0cEW00O7J64lbT1LTWZsrOdve0BaVPkEB2tuBUtg3U+hDarMdbJD72ZYniAsWHPWdDo20bMjUBtKayrCeKjGzMXcGdFV10Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Bcdbmhcp; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Bcdbmhcp" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-36900945df5so3162584a91.0 for ; Thu, 21 May 2026 07:48:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779374882; x=1779979682; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4mtwRPah/bLATx6RFt0C3QCf1Zldq1D4z7+HKhDsfT0=; b=BcdbmhcpIg3BmHtFuL7hjmv3fUftzTae5zUPCgAjfG7w50/w9iAjCu/lBYzHSyS4r2 Vo285i6VJox1jj2g5ISCHMDFCNgUBCl4EMRZvdAFQEzmBigDGFNdtHePLP77YNRCOh3C PI0kSc50VYIHnRYpdWkfKaYZzgRal2I6SH6WrR9YE6pAoxLg71dYYvTFZkRNo/1VHtZm oqLednpGUpGL/E/2yxJUDkM8eydNVenVl3zv3+7W5QEH9UwcO1hKOndIHbKxQPQnDIPg fTCSEiRK4b85wFgjWhEZ+pK6xBQswzwG8Yv2K6Gp532LGAQTv/ioTx9MOAklyvT43wem 3S7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779374882; x=1779979682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4mtwRPah/bLATx6RFt0C3QCf1Zldq1D4z7+HKhDsfT0=; b=WvteocjkG0gI5U7x4xahRyLkAOxHT2w1SdAJmVPLHNyLQGMRQeTv3Y/y9LVvXhZ8F9 zh6k/be5t4GinBJY/P17eBnYt/PKixCq1fbFxMtD4WhvyKGTOWvLoHvDM6xOOrs/AZ5W wNbIOFrLfMnLP6eLpDqVTJiWTqlTlPjQhOzOeCD3eREa9l8CxxHXdPXbix3KLs00aAFF XFNxWqzun9O4fOz7l7+SsywroBhQo6ZABuX0eyoKElcxK9nwgjDHUxzMsUkXkQqYdnta HZ7IT0y0xkS2jvBjU7VFi4gj3UccCwI3tIeMmU9clagW/M3kzsZNr2mAeoU3pm07MmF/ Xm4g== X-Forwarded-Encrypted: i=1; AFNElJ8FcqiX1aLazy/gXUD7Ql25ItTuX4D/r5x38fJv2bYCKO+0bjL88mfnzhRWIulPih4PrLkcNgfAe30gOeg=@vger.kernel.org X-Gm-Message-State: AOJu0YzUEUjue/Wsq5XYttn+Ra5/wWZYhTq6bsCB0hu9aKyB9pTFE7gT Ci9f3d0qerf8LzHZV7F4BwkMZdm3EyHUhs8q1T6HzvZlQEmBS/mrmtrM X-Gm-Gg: Acq92OELQHTJZfAEDMPWrutafIrsqxi9sgV9rYzllii3YtKs/7gkFsRHhAJAFldkdTA hiqJg2UQ28d14mwei/OUvpoAer3ixl2XNsTZNjqPGu9NTzKVCZo52ueiz3jVjWfFE+KswbqFAGk /uR20R1hRd9g28x4QvSHHh3ThgKu1qYoYi1vEObTJmLP3PPHiPlWmOpcOmhUiiBlp7WuZ3kbpTJ dPPnPzA23y2id02iJgByhQU1J/Cu9UO6PWAvgs0q3CyjGhlMn+TraLBneu2cmcRp9kdQZKHpsZZ fsoDZl2wXn40SzRVjqDQpU0oxfEwS9oWZ5AmuexGrlD+NdBbQDJSeoU1Ic0G2rdjdI1Mp86H0EW +LdUMyZOr1SEsnNJ/kNZLUmMlBSla3+dDxbLHV0uaKdUHRTKiE0rjPAuSUec9eht+GkyHbmo/lo iT1o9TPXGQ1MTXueOxUQmZAmSIJmnNxg69WbeCVjanUKseUPRSBZDkdRy5Kf0= X-Received: by 2002:a17:90b:2f8d:b0:36a:31c2:d402 with SMTP id 98e67ed59e1d1-36a451592edmr3478966a91.10.1779374882162; Thu, 21 May 2026 07:48:02 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a3cc5643dsm3773472a91.7.2026.05.21.07.47.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 07:48:01 -0700 (PDT) From: Maoyi Xie To: Vinod Koul Cc: Frank Li , Geert Uytterhoeven , dmaengine@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] dmaengine: mpc512x: fix dead empty check in mpc_dma_prep_slave_sg() Date: Thu, 21 May 2026 22:47:54 +0800 Message-Id: <20260521144755.3476353-2-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260521144755.3476353-1-maoyixie.tju@gmail.com> References: <20260521144755.3476353-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" mpc_dma_prep_slave_sg() reads mchan->free with list_first_entry() and then tests the returned pointer against NULL. list_first_entry() never returns NULL. On an empty free list it returns container_of(&mchan->free, struct mpc_dma_desc, node), an aliased pointer derived from the list head. The recovery path (drop lock, scan completed list, return NULL) is dead code. If the free list is ever empty here, the aliased mdesc points at &mchan->free. The list_del(&mdesc->node) that follows then runs on the head itself, corrupting mchan->free.next and mchan->free.prev. The free list is reachable empty when the descriptor pool is exhausted. The author intent was clear from the recovery path: release the lock, scan the completed list to free descriptors, and return NULL so the caller can retry. Use list_first_entry_or_null() so the empty case returns NULL and the existing recovery path runs as intended. The same shape has been cleaned up elsewhere, for example in commit fbb8bc408027 ("net: qed: Remove redundant NULL checks after list_fir= st_entry()"), commit c708d3fad421 ("crypto: atmel - use list_first_entry_or_null to simpl= ify find_dev"), and commit 10379171f346 ("ksmbd: use list_first_entry_or_null for opinfo_ge= t_list()"). This site was missed by those cleanups. Signed-off-by: Maoyi Xie Reviewed-by: Frank Li --- drivers/dma/mpc512x_dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/mpc512x_dma.c b/drivers/dma/mpc512x_dma.c index 0adc8e01057e..f5934136efc4 100644 --- a/drivers/dma/mpc512x_dma.c +++ b/drivers/dma/mpc512x_dma.c @@ -706,8 +706,8 @@ mpc_dma_prep_slave_sg(struct dma_chan *chan, struct sca= tterlist *sgl, for_each_sg(sgl, sg, sg_len, i) { spin_lock_irqsave(&mchan->lock, iflags); =20 - mdesc =3D list_first_entry(&mchan->free, - struct mpc_dma_desc, node); + mdesc =3D list_first_entry_or_null(&mchan->free, + struct mpc_dma_desc, node); if (!mdesc) { spin_unlock_irqrestore(&mchan->lock, iflags); /* Try to free completed descriptors */ --=20 2.34.1 From nobody Sun May 24 20:34:04 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52ADF27AC31 for ; Thu, 21 May 2026 14:48:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374886; cv=none; b=pWbsiH7GJnSda3w9g3enY40aox9Gxvm9f6S1Sxw5jQ7GnV8EZdpxHALF0UYGI6prOeQHHARSKUvQXzHix9PBCpUQaosi08Kby3jJYXEGuC5T6Tc9Sxe/BTCf2lxadRcUjAxBXi4ZJqsfdknx0M4eF6GdmbraUcJDGk9vHMAem0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374886; c=relaxed/simple; bh=fbgf4rB9r0KXPx1Oc+/VkrmhBfp5gpn9s2sD43BntBI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=lmKxa2beuvvD+qJiGCAPJGzEZg/cTHyqYjr3KqI+2Jo33k2PXTCTn8pLy7TeCfUgHRJuDq27aLhVpBRaCpG2QEp2EP6uYlEKLgUt7uNsDPe3cc/v9SlEBUEUP4ekjz3Re7WyCLoRBGVPukj46HCypbCQwjwstROb+8AH7yF7aPs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IvJCklfU; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IvJCklfU" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-366139223e4so3636683a91.0 for ; Thu, 21 May 2026 07:48:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779374885; x=1779979685; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=nz2OvYWMh0kl6XvmHG/s79tvFsmkhMkBBeYvzMmnnb4=; b=IvJCklfU1mDZXWVqLLRiUgYfm5PmKdEsALpqmJFTw0CiURs65uJ/TsYvOeEM4kZd+p SuqL3MFF5GGUFuC/1c9N2CddP5G2mQwoaWbeAJI6fWM1Zb4+qbdSz664afWRUpIDxH/w mY4+sKT0RYXnPssj0dYlFB/MWf0zPQ4ygjjXy27plKiwlWi8maR/uKxOsiLUOHLelIH9 L2sN3zH1aIqGPOxmQyANMSGi59iOHMeL1g0KOgbUC1OXQTEwHjCRKTb8+x1TZY2mJkpR 0+/iMa1ohPacptgGbFJ4M1lwR4FC/wBM+AU0bkmVgiJcrhUnL8/YrMd9VEnNFlUkhYee 5lww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779374885; x=1779979685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=nz2OvYWMh0kl6XvmHG/s79tvFsmkhMkBBeYvzMmnnb4=; b=Epz5b7EjSrcrC7f14VTBcGMvi5Bh+WZdoOvOKc/V1SsjjqqWm9ISJLZMZfTk7kljE7 Y2bvezpx0fBWPPPNSZ+r2zXUXsLpqzcZS2xISPO34YcnWS+/tlBKyGmO9MmnXi6XEqDg nHpY094OL4DEpUNtFxij7nraWiWLj9GxzGibVY4CbcTHPwBwgUz06AOZ8/7FxRgHFeN5 FJHrHwejjHoGHLRzJ2UEksAHGkZQBLEc7bopoEC+v3m6d+CTtDvZ8tFc12hwGamMfCYJ FqQNk7u9gTkG7J8ACSxMCwncnW7DHxetjs/NHNqvmVdIdjbgg/2i4PotEep+wc3lZaaZ eCQg== X-Forwarded-Encrypted: i=1; AFNElJ8K9k62XElqv7An0BO6BXnBT1d5djnQ/+0sHTiaFo9zOtS3iXmg3gy+lmKwMztLzeCAAPMjxgl03IjAElQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxkKxA/qI5Z4ai611uVPk7hcYkrmKVByDN6gXOK9F4Ml/deUihd UYVolBb6fpYoW5sQyjbzjH+08zT9X72n1/xRX333Hs69U9tABlYXJbuk X-Gm-Gg: Acq92OGT//ps7h2nWlPTppo15aw57oCUjPClntatwUfjbiwqC4JtfHEtg2BEWYoQ5vy g5U7e8iVDMHPqCiqOnXHMSNytI7vZit95J/9z6bf0ZUWi7/yfzy7qa3nRWwwrPr4MbUw3sH16IN elp0VgngpzC/XLXwd4kBQlSnuP9ucx9x28id3uBh9hRFfyjhNYcmKyRdGlw2DHSN0n1EsRX2gqj Ct9QCAOhJ+747CPlDGx8cQ4yTogWY94glxXXIh5otMldRLo+9pjl5nCDmwyL99bEoQMITNoeQmg SiP2C5xqeBKH4PKeP1J5UJcx1QK5w+G6vvvIFKmZJZebHEI7iHdE8OxGgQTysyfqIZnWPOi4H+S juB2OFvhCLLmTtBo65OPejPUM51EJlkD6DGE+MnXGXVAgmMkSZIfqFQdHfiHV+EMCAnt/eLwCgz TKJxpi0ftOCexkfR8ejjKwNPkWSWBJd5NdLO5iwqT/2VP6VO25A6ggNvYKWgQ= X-Received: by 2002:a17:90b:5685:b0:368:6ff3:6678 with SMTP id 98e67ed59e1d1-36a4561ca97mr3064735a91.20.1779374884646; Thu, 21 May 2026 07:48:04 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a3cc5643dsm3773472a91.7.2026.05.21.07.48.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 07:48:04 -0700 (PDT) From: Maoyi Xie To: Vinod Koul Cc: Frank Li , Geert Uytterhoeven , dmaengine@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] dmaengine: rz-dmac: fix dead empty check in rz_dmac_chan_get_residue() Date: Thu, 21 May 2026 22:47:55 +0800 Message-Id: <20260521144755.3476353-3-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260521144755.3476353-1-maoyixie.tju@gmail.com> References: <20260521144755.3476353-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rz_dmac_chan_get_residue() reads channel->ld_active with list_first_entry() and then tests the returned pointer against NULL. list_first_entry() never returns NULL. On an empty list it returns container_of(&channel->ld_active, struct rz_dmac_desc, node), an aliased pointer derived from the list head. The "return 0" shortcut is dead code. If ld_active is ever empty here, current_desc points at &channel->ld_active. The subsequent cookie and status processing then reads bogus values from the head's neighbouring memory. ld_active can be empty when a residue query races with descriptor completion on another path. The author intent was clear from the existing comment on the next-following check, which already acknowledges that the descriptor "could now be complete". The empty case is the limit of that race. Use list_first_entry_or_null() so the empty case returns NULL and the existing "return 0" path runs. The same shape has been cleaned up elsewhere, for example in commit fbb8bc408027 ("net: qed: Remove redundant NULL checks after list_fir= st_entry()"), commit c708d3fad421 ("crypto: atmel - use list_first_entry_or_null to simpl= ify find_dev"), and commit 10379171f346 ("ksmbd: use list_first_entry_or_null for opinfo_ge= t_list()"). This site was missed by those cleanups. Signed-off-by: Maoyi Xie --- drivers/dma/sh/rz-dmac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c index 625ff29024de..3dd76615881f 100644 --- a/drivers/dma/sh/rz-dmac.c +++ b/drivers/dma/sh/rz-dmac.c @@ -723,8 +723,8 @@ static u32 rz_dmac_chan_get_residue(struct rz_dmac_chan= *channel, u32 crla, crtb, i; =20 /* Get current processing virtual descriptor */ - current_desc =3D list_first_entry(&channel->ld_active, - struct rz_dmac_desc, node); + current_desc =3D list_first_entry_or_null(&channel->ld_active, + struct rz_dmac_desc, node); if (!current_desc) return 0; =20 --=20 2.34.1