From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E636F3E1738 for ; Wed, 3 Jun 2026 03:08:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456096; cv=none; b=bcynWMhEBHlGFNEj/F53C5WMR2+RymVfV6U1JR9YrvBHDOgUJUmM4tLiKngTbWZXio4VIn9SkLCOhC8uNVI0IVNKJChwEBuz04izyMC1VGpPO2wR8i9voYTzY533xcjWAHj0cWACGVaMY7PuS8gydyuPq8BXVtGTMPNlsbZGU+k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456096; c=relaxed/simple; bh=hx410UHSdlgBtjJ9H09sx+B50T4kbh0WwKJI7BtUBdU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=o6Zjwsu8LxleMNCiarJSFrlVOEq/WISNbgFZuP0VNYRLNnKjsD0k4aqPN9y0ZqaDml0fbCzMGDazFmmCodSs83WhuznLAAhxhv6t4wPmJQ07CkNPDJLTaGYAX4IxbAkW5G86TTVkWfp6SsJxqAOgM100IeVBS0hKoTf2pYE5lmc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=azF5JePy; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="azF5JePy" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36bcf3d2565so2954630a91.3 for ; Tue, 02 Jun 2026 20:08:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456094; x=1781060894; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4Rpz+kGKDCFvWJqFvwgzUCdW4hrGHMFwU4vFb8j+Ivs=; b=azF5JePy36swlzNpOYVtVm0tRqu65aVSrAxaDuv++2SJRW6lcmoMtsKFfJY9paWn1N as3oKKtfsDuU1EP1XIjvz3tZ68XlBaEt5dwwMOl8IJf8ft3MLe2GU7kA50gTr+/3R0a3 yP1K9OQyLkLOFJ+axFvRSE1A0ijgv08zz9TudzsXfkxMWq7DwP4mKexTxr/hQUHh8dqt pIC+2765WHMe19xpvQYUvRAAjPxHbFqg7xWTn7/jlk0KuswZly/Poq9zE8svC7za2vw/ dvDwAZ4YhQrlEf0kM8Zq4cCOqk1joih0RKCyGTk/3hh9rDITGWtSzFhSpdMSZ69duZ55 1z2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456094; x=1781060894; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4Rpz+kGKDCFvWJqFvwgzUCdW4hrGHMFwU4vFb8j+Ivs=; b=I4++xgbMlGVvTxTfjA+dom0Ny6fchJovFrCBKeAT4begTkP0Ro13YNK7IkA+aOSg43 el7osDlnlDya770iP40HnztAICxU+XJvBDPRgZ7hvLvONHix1fuvplF+JaDod58a8hC8 omTmYDI2vYXjctZui5Eqp24HAqnUG2YhUjtNBijCaLSJ1x9ipdjneRdFHJnUnnQsQcGB JtBK90Lo5bqker2uYGi+VPVC1LYu0ShDj3qY++mX39xKuH1ec6DbRQ1UY4VgtC/7dD4c /ThM5aqabphLi5y04yyXN98aPfIyN+kOoz6GfDPJ42SvFppV4EEHtnewH9aklht+SB6y CaoQ== X-Forwarded-Encrypted: i=1; AFNElJ/Q3UNKLELN+2Fvp8lkA2SWWS9CjpanjJIn6jCEZucmsilc+FLdUALT0vlTQ87lv0QcjNTnQ0wbaYAIrUo=@vger.kernel.org X-Gm-Message-State: AOJu0Yyt07uOvj6CRkwW1kIaeXEvPAar0VuD7qEuyD83w7fVb3zEQE68 C+Q9WuUj/K6cBRCJGYH8WAY1hhEqJE4kX+tjQ/Doc2AdcGAP0LNx9GTN X-Gm-Gg: Acq92OEtLouUkuvK2QZF4L2SVSOH7ttjQIh4l/81I74Wyb8d/oiK654B2LmstqHcth6 cML/8AT70LKfT9RRUNtvhOX0vBvnb3Cjut0IBhcgQotWZixnWkeQlKlMcq0a7KL0K0IWG+d0/mM JEU8HDDsT68JjwHiEE0QyNVyx0gSlWocntM0MZJT0wvaurQyZtskY1pTqDI+BQybxoyrrkW6cbR oX2M8+mItsJOR+Zw/wnXHVkbmb7fBYTVXHEyAnGWXHrUQ+Kt6Fsaesiu8+60Ta/gwIDBt9VTqtD +gcQps/Wsmm+Oi2DzTMnnXi//6c3g0lG5ZWvDf9qdNPQXw3rj2/Cmq47gw+9uUZug+3s8r/0zbc ZHhGW4/1idaMGHbg+S4iJQuWLDDLZJ3ngdi2iphpJy70hpk56rMO7A+ukLt2zQptGJLOU4T3qwq cZdkPPRsGX1nW9ExVFLrz8Jtk9+hBE9HnQiuYRoNHqDwy/LMIpR8qUu2Hncg9Wu4vdWt90HubXY zCGanczHYdrE9myDrRmKfcJms012x6wdW0gJSKukG0Czw== X-Received: by 2002:a17:90b:384a:b0:36d:66d4:270d with SMTP id 98e67ed59e1d1-36e32b3bc5bmr1473910a91.20.1780456094147; Tue, 02 Jun 2026 20:08:14 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:13 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 1/8] dmaengine: ti: omap-dma: fix missing return in probe error path Date: Tue, 2 Jun 2026 20:07:47 -0700 Message-ID: <20260603030754.288757-2-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If of_dma_controller_register() fails, the error path omits the return statement, causing probe to continue (and eventually succeed) despite the DMA controller not being registered. Add the missing return rc;. Fixes: 2e1136acf8a8 ("dmaengine: omap-dma: fix dma_pool resource leak in er= ror paths") Cc: stable@vger.kernel.org Assisted-by: Opencode:BigPickle Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 55ece7fd0d99..0f6dd6b0a301 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1828,6 +1828,7 @@ static int omap_dma_probe(struct platform_device *pde= v) if (od->ll123_supported) dma_pool_destroy(od->desc_pool); omap_dma_free(od); + return rc; } } =20 --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CED473E5A24 for ; Wed, 3 Jun 2026 03:08:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456098; cv=none; b=BS8GQJqLIuk/1qMVaskNLr0EObDP+nh+icDkpKyvuMr5GeVydXx98VcA+6Ym5QPnu91wjGKjtgUv1cTFXQPF3gZIeW6kVPhXdtxt59HlmCf7TiCmN0DAZgyS6JP9smADhg7SUDlnr8X3ptVBuVjmdHLsfBkdPsad7b2w9TMfNkw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456098; c=relaxed/simple; bh=+PVqljYAEuaHeLfyyM+CGl4qW0A24vMOocrK+WLBCf8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=c0XkJdCp12u57cJAqarJjAjdHgU1/5JSMmUtwb47aXrMRR11Aw6DDHKKqJTWauFyVyjZqvFouW59d1po/EpQUVSuDppxhX8HfF0ofeJgOoNLgYP6UzyNWzsfcnEOIeVuXk09qfXgz+8VFNtnG38fSxNHVAN4vnJIizCxnE5HY/A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cu5++uHB; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cu5++uHB" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36bd175fdbaso2774779a91.0 for ; Tue, 02 Jun 2026 20:08:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456096; x=1781060896; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=RD449MAq8gcYE5XoSdNvMg3UoSZBswuYPEgYBJrnJS4=; b=cu5++uHBq0jeWVyVb5uLRQIxJI22DX6gA36+TJXNqFi2FczCD80J0dE0ZmfMYmhfR7 Ez+2G3OwqrbOVLrlpIdbHR1ujPWbYA91i6OyWpBb+IpTq2JLEyihcehsZyl4TAB0XsG+ 81jK0kCOBS8NyG2qEYcTjxHDRwvvkRsEpA90FLI6jN98g+i0BDpxDFgfp3zudnYs04IF uPbQkQRkDMLVrgFDqnOP6BY9UpZki/UsfeY4fpZmnSGpPF236zUfD7FvLUYOOmH/hyfs 7+W0WiPHtXywTQL8ef+1eV7Lvw3u5gJwCduel5YJdD4bbYmpMHS8NU4zUv8Xa07iSjGA B5sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456096; x=1781060896; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=RD449MAq8gcYE5XoSdNvMg3UoSZBswuYPEgYBJrnJS4=; b=X1fVrBMOnyRNQ1wKhoowsX1GD8E1xnWDeM3+PoveBqlJi2WuTmE8eqA9od7R6ecNsb cVzJuvt7hB5w1sqNsCvCp4wLLQdRzZHRoE1DSsa5yrJkwmY2+acssCwBQr6iZZpASN/E pzXnc/cqbX7iEsjRG0X37Ax7NHLnfUCfOhw8kWFu17dqK67Vu/2otuIfLtvPPvf5/BHL T0XDTP8MbYHy1aRZRJiL2tUEqLNnU9mFo7ixnvoN7FWlYllPXvbbDjVlYFnGScCbEx5r A4yHo307gTySC3o1c4Bn3zvmCXKGM+1ScANWZcPdCCxNQwHWwIDZ/Ggm/bE3aC7tuL7N 76FA== X-Forwarded-Encrypted: i=1; AFNElJ/37XdL2xoXtbz1O9LmE5w8CZ7dp2j3XTkY4p3i4Ty9MbJt4T1CxJgKbqHTvxSRfQbQfpCiBP0mDr4LSqA=@vger.kernel.org X-Gm-Message-State: AOJu0YyrWz+XtQvbfJkF6ryDjKz1GNl80Ipv3yBDfwfRc4pnoQQfyD91 D25V815LjrW09NnLIlXBgt1Swz4I+pC7DrfyakcRUOBYrYri3eUQXjr6 X-Gm-Gg: Acq92OFq5c+ZawooRlKbyEYeX23yRIjrJAqMEQboE/LgSxvphRA3/A1c9VS7ipvIYc/ HYzN9L9CWycuCAG+HcAZmQY0QhWIghm29zByPL3fbygd2hpJ1WlLzQY8M+gKDceVtcOvoHu/2lp vWoQY+KsYMD7WDP28zTYulapy8HaFuBtTQCh3M0OyJa0rN/ZlT4IBqtfCtBvhetXptHGmmbuc3T NdPO3O6UNIHDyKNtFDI+e+s631xPX20yUqx4b+Ju9toY4ToEroD7B3a4CdeviHzltRowwTYKwQp xG/JiJlESNzTxioMxi8/d0Gz6LQlAcjMYAIEja7qLp6QTKpNjz6iy9LdAtb84VnaLQO3hyVpM8y HOuklCw/fXQkpW9FVp/XJts32n6ES+A+BOaD9+iwLJ3wOa2nnxGYJdy3lTi+unM1thMgzvbeyNO 7GnMn7tWJwEY+jIh9tvoHa48foev0ZBFuyr0srlg8I8tPuNVcooPPsOUEDcekxfDRj44el8jYHs hYpaGFy4XWFJDxeWzUoZbXY0qAgzhbe2Z19bONRCQVKtg== X-Received: by 2002:a17:90b:1fc7:b0:36d:8f51:fe29 with SMTP id 98e67ed59e1d1-36e32285958mr1450616a91.17.1780456096056; Tue, 02 Jun 2026 20:08:16 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:15 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 2/8] dmaengine: ti: omap-dma: synchronize CPU PM notifier removal Date: Tue, 2 Jun 2026 20:07:48 -0700 Message-ID: <20260603030754.288757-3-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" cpu_pm_notify() walks the raw notifier chain under rcu_read_lock(), while cpu_pm_unregister_notifier() only unlinks the notifier block. The controller is devres allocated and can be freed shortly after remove returns. Wait for an RCU grace period after unregistering the CPU PM notifier so concurrent CPU PM readers cannot dereference a freed notifier block. Fixes: 4c74ecf79227 ("dmaengine: ti: omap-dma: Add device tree match data a= nd use it for cpu_pm") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 0f6dd6b0a301..15be3c90440a 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include @@ -1853,8 +1854,10 @@ static void omap_dma_remove(struct platform_device *= pdev) struct omap_dmadev *od =3D platform_get_drvdata(pdev); int irq; =20 - if (od->cfg->may_lose_context) + if (od->cfg->may_lose_context) { cpu_pm_unregister_notifier(&od->nb); + synchronize_rcu(); + } =20 if (pdev->dev.of_node) of_dma_controller_free(pdev->dev.of_node); --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6111A3E5EE2 for ; Wed, 3 Jun 2026 03:08:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456100; cv=none; b=f1nyzIC7bSKTzk0VrYfSb7TTRrwlcoZ6OC6+qcNJCPNZIbaQOCxb4ZYgIP6JfHxsuUQBwkzsdkwpkEV3Kvg7VjECq5cRqbUvOEVyluu3JPEr7ZIYEijGLKPH+/ZymxjEcKsBtzfh5pfyYsQ72R1XKZNAaUxaP6W546AY3aVaTiU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456100; c=relaxed/simple; bh=QpqYfGjnjza1yDhq9iuXBzv4lug+a++X1dRARkJ9T9o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WMHDcTQgMIP6fuN9PyXlHmbsI4SJjtlx4pSQSxSZKfFm/LZVKtC7ZpXZqrkwsVJGcdUtIefOmpfqeA1dvb/rOyykxZtzEiF0N6zyJxv8UVD+UGk2AIK72BI2BcEdwYKYZSOQIUk1xIml4jzrENL56P/oNJsAJnxv2/N81uJUvl0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pjB9hu8u; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pjB9hu8u" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-36b9d265355so3474094a91.2 for ; Tue, 02 Jun 2026 20:08:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456097; x=1781060897; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=t6nTg19H1aEF2hCty9Ml54+E9Am0ueL/QSUT9WJYjuQ=; b=pjB9hu8uA/4mTOy16n/+MSPwNBCtkXckDHZ1HqIK+TDFY8pTEQPQjaTFK5RfQsK8qz qMavdKp+oVGGe35AWEWgeJgCwd1sQ9aUvv0cGaBGpzI8e7vThAf+z7vcd9hliPkEL/33 Vs597EMyOsJsBFm8/gQKz2/5Z1F/jK9C4jL8NZdTRU87yKdSysB9MMzzKgqoLPccfvGS JppTEdV03ad7nucVoW9lmbJhfOGgLosayLwKwd3gwAYmMN3MjdsEOJQVtxnSbpCAvtXF bOi+j++kD80tStJ5VWGpjRoSsS0IPaW52DvIDsU58lDTRWdQd07rxqHo0CMPaFQ9cG/b 6Ljw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456097; x=1781060897; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=t6nTg19H1aEF2hCty9Ml54+E9Am0ueL/QSUT9WJYjuQ=; b=jz7KAZGf6jeCqNj4rCKtSKdHk+SnuUdvhA/VMlYYaj3gkx0/mI4mAbRzJV79a/AE7z vdEYcZwtLyekVVc9NF8rlE7OzDoMJyTm3JOF9mbeVlfHQIk4+DolqP2ovati9r7Whcy8 /TbrYYObU7EWWdJezRC1/3f0s7j7Eq1AqP0i7Whz+g2tVLDBBRaxeKUpEFPH/jqfq75b jP6O6uvdM0lYyxv/3IRhCh8ca+X5+w2ihl9PyNJ5MlhHnW4So8SAKkA+9fZAx5IcTYqR zafRgmiNk2TyaXSANxOImYPc8/TgGGQ56CQVgSF4qyLBZdRlRdAQpoxOBSh2ZI3R7YIg +WJg== X-Forwarded-Encrypted: i=1; AFNElJ/5JvTiYixsiR8U6x0WR1+Y0k4i23pKp8uBBCrNv7Nz5uGJ2FyKYJv/SA07ljmErDtolPbR01634qPw2js=@vger.kernel.org X-Gm-Message-State: AOJu0Yy+DbwtH77lW8BOrD3AoVZWRusEMtRMQ1NDUXzvPZt0z8Xrrp+/ k7wAXk1JqaAe5IknZWBJaKQpRmmIVRtbLUwDyB9UPLaFPa0a6VzcKgea X-Gm-Gg: Acq92OHylG0wTO3xWfqACI2tPLr/pX4n6O5wzBV2RUmPcfrlR0f/7oEMftYyuHc8css vsv5sqnWqzH9U9WUE2MPirW7z233BtzAaCL34cjnGB7v5aYNLL28/SO5eVDmxmRjMeysT5ycDI2 JXRAkGKZzG1gbcaAzzLYi3iuIkGV7BG5o3XofkI97IWxeNhmieDvg8gtrEyfbdNcprbtBiMTvZA otTyokAd7vfSJM6rrj4NsUp76mFEPswFpQkFAz3PPAZyGccaDgwdE4ioLMk/gVLghguTq6qRe0X bGWkUcd6B+ltL3jXqBXj0K6DrA8AnxOxccwrlUi+U+QQtsvlMCGNKcHfWhsC4Dg3laeuRKAOuu3 mzBjhpSJwOktZjNH62ByNe5zSimyRw0EVM+z9u3B9WDPDwawyXGIQyww+0cwwvx6S8K96dK039o 6iCCJEYVNmn+TkPL0lH6vTVTAtsDYixonkv+fIrwoAE/Pb0D3IgZUPp4dQdj6/Cug+pW5/Z/BnT eSMu1kSaAvF4azyrjbJocvnuo4c6ETo96pJ9hlhgro1aQ== X-Received: by 2002:a17:90a:e706:b0:368:ed92:6f6 with SMTP id 98e67ed59e1d1-36e2eede4acmr1636874a91.1.1780456097562; Tue, 02 Jun 2026 20:08:17 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:16 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 3/8] dmaengine: ti: omap-dma: fix CPU PM notifier leak Date: Tue, 2 Jun 2026 20:07:49 -0700 Message-ID: <20260603030754.288757-4-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The CPU PM notifier may be registered for needs_busy_check on omap2 rather than may_lose_context on omap3. The remove path only checked may_lose_context, leaving the omap2 notifier registered during driver removal. Check both configuration flags before unregistering the notifier. Fixes: f4cfa36dab67 ("dmaengine: ti: omap-dma: Use cpu notifier to block id= le for omap2") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 15be3c90440a..0ad8da8b35f8 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1854,7 +1854,7 @@ static void omap_dma_remove(struct platform_device *p= dev) struct omap_dmadev *od =3D platform_get_drvdata(pdev); int irq; =20 - if (od->cfg->may_lose_context) { + if (od->cfg->needs_busy_check || od->cfg->may_lose_context) { cpu_pm_unregister_notifier(&od->nb); synchronize_rcu(); } --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3248B3074A1 for ; Wed, 3 Jun 2026 03:08:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456103; cv=none; b=FpZ6SJ/iwj0MyDTdhKwZ9aMxoAprpOvwH9FEXLEZSAwf++mdXEKwI0rMSJOi2LR4W2g55buhrFO1kSCdebGFTRF8h7n7nKW27diUplVyl9mVF+qKOM9FcUjTqhBOcH4U/dFW1uVTE0MjkpQm0Pk+NM9UcEzdctT40NygraDXKpQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456103; c=relaxed/simple; bh=xkKW8ssF61j3wciQU5I5OgNSDBxKhZtUrbfTMBdFQsE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rAB60h/GH/d+amME+oRof1rADvPYjGS0/7ORVLKra0dWofHpyOL5cxHIJPq57tF2wbg0k0HfumOXBN2u1aaz6lu7fBP7kIm8SnPmt8/HYMDWDu0FjTwnxJBhLCi1i9hnNjfcOCWvVMUI7zxZhn6120vthkWxHw1x22PjWyOuUC4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JBVBkwcU; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JBVBkwcU" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-36baec934b6so109809a91.0 for ; Tue, 02 Jun 2026 20:08:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456099; x=1781060899; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=QzSNw5MqtTwHbrXr4I82ADeuVf15/M6YUefhoKAdT3o=; b=JBVBkwcU1sDDCJ6T7Gxl5OcOCO7ZiWgLQfnKaCbbSIwaGOZaF9MM/zNzeRmWiBmwpa s1dP6fpaZC4OO+DBM+w5LgCoQm82MjqYpqUDLWaWwp2u9Qk8wDDf3M9194NN8+RRYkgQ TVeTwcAOjC3/45DBxO8/bsTDqbX84tBpxy8/AmAR5D/xopR6yCUknSnIZicycnASy6TF NBwwOhJB6VfCIc08KtDJrpBZ/IX9nbiOBF/DADvUg5OxJGvYzke+MANA5OyajQiOdqnu Cxj61UDr16hYeV0FOaR2tn7FUY5N78Q2vS6Ycl5HxRbwvdDHVtfZJrbrby+TnsjIkS+S 48EQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456099; x=1781060899; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=QzSNw5MqtTwHbrXr4I82ADeuVf15/M6YUefhoKAdT3o=; b=HFQdnWxJI3tCPGZl/YSBBy+Ccb2Wb6tIWFJWNFydSDXfS+3uvC2DIQmC1IyPGsYgj5 o93CSd3w/pJ0pjifJUOO+7n3p5EkWS+tNFyaEXmj9AvFeptCBk0eZurT8xSy6j98GiVF kWD7fEjMUx1k8TCZVWe7hmRktTnC5waVK+pzOt2iVCfXX5metDDK2kukGO3zdpIkccSK HRtUxPL+L0JT2VOfhuC4bOxh91Fpk+xX05d4X42KeNUaJAvP7/gdAomIyrmFLM8bAe/L 0rSAo53+/UV290Ywrw2WZhPW7WcHsbo2/wvkKLTtr/g68bWMkscaoZxcoo3w26R4m/EJ 9fjQ== X-Forwarded-Encrypted: i=1; AFNElJ8BDahLh7iczMXjuOSxXOKPujWxBYz6OnoBKS/IBwZq9+8UbYL7NM4osr8pmvVAg++dkPw9hXtbZHbU7Pg=@vger.kernel.org X-Gm-Message-State: AOJu0YypEbx/C7R34BpMEK0b1X1OaH3vHuwk+Oc7QlkwOmYJYEKPzHBX EAT5HRLgjzWR2+PPUTXpZSOswEOOWXCiMsBjP81v3csuf4fBC2o05Lf7 X-Gm-Gg: Acq92OEIqNP4PHogerBlPPCGaPSwZIexqk21ejgTWkmQPhuRpwzv48gWeUbFyYFPkSO JE5ZufzxWuQk9grApPvB77uhmtyH2G6HEZNpCUKW15rq3gU9fvfV0E74REtOE139w/E+UUtQ9F2 x/bD992QcOHcfiSf612TIBBjRxlC2epQw4JmPw/kq3HihS8KT/HBuQaLNOoNpOv8kTOQGf/bJdq YOdCNTI4bD0NKm2+byzl0BQt0tJxlQ/Edculv/nf42YEpUL95SLEe7bS2QgmX4Cr+BDooAHS3dH SOu3xVkrczN5KC5Ls7+mfZTurhAEF/R7SVV8Jui2mMsrQCd0H5+AXPV6cJ2Zev30Iy53mehyJSb LVCd82fHK6LOAJ6Lzrgo0zt49mdVGmLzvfIcg/VDvwXzX8767P8d2zCSWLcwWVsNNBAz9HFAiZc YaH7SZ0/4ztUWBwgGHy5KXCzFWfR3RaFg0EMLznQa0C/5+uJruadTD/dvKNWvb8wzCxgsxC7gwa N5lRCAflVzuTXQyw0vyDa0T76lOWt+jMrn40jhswDrnTQ== X-Received: by 2002:a17:90b:3d44:b0:36d:630a:c4e4 with SMTP id 98e67ed59e1d1-36e385786f9mr967492a91.3.1780456099427; Tue, 02 Jun 2026 20:08:19 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:18 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 4/8] dmaengine: ti: omap-dma: stop channels during teardown Date: Tue, 2 Jun 2026 20:07:50 -0700 Message-ID: <20260603030754.288757-5-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" omap_dma_free() removes channels and frees their storage without first stopping an active transfer. A channel may have moved the active descriptor out of the virt-dma lists into c->desc, so freeing only the list state can leave hardware running against descriptor memory that is about to disappear. Terminate each channel before removing it, then drain the virt-dma resource lists before freeing the channel structure. Fixes: 7bedaa553760 ("dmaengine: add OMAP DMA engine driver") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 0ad8da8b35f8..cef4e3a38b04 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1521,8 +1521,10 @@ static void omap_dma_free(struct omap_dmadev *od) struct omap_chan *c =3D list_first_entry(&od->ddev.channels, struct omap_chan, vc.chan.device_node); =20 + omap_dma_terminate_all(&c->vc.chan); list_del(&c->vc.chan.device_node); tasklet_kill(&c->vc.task); + vchan_free_chan_resources(&c->vc); kfree(c); } } --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 749153E51DA for ; Wed, 3 Jun 2026 03:08:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456104; cv=none; b=ff9/btd3wr1XRF5knFlONd7n4iV6h1/i/WJ7uV7Nhe85hjSLDEAXs3zeOZLspzGSXy/JlB2TsWYcysmnmt4r8PGAwfFkOIXdaJcaCnSa9FC4msnrEDOUATSHbosnzVOhKIkXx3l2EhHx1PwXR6HwDizXry5z3gnlG4ECa4mWxAE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456104; c=relaxed/simple; bh=O9qpMQO4gyEQEH9XMabcCwD7cgwVapAp8DL4oHFYuDU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CstaV/MOzrVHfk1Ot5Wxdd4DUOYLXanHpRND73nErJKOho1i5Jv7kRVhjVfKqcOA9/dqFG0LeKbW2cxA6zYzySdukyduKQfvU2OPGyuxKla1DSAjOBUmCmnoBDrfjjy6jmJS78x1iPV4Ig2Wl0WnaJ222aXxEEbRQSQXX778bJs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QYxgE5xU; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QYxgE5xU" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36ad15213fbso6056541a91.0 for ; Tue, 02 Jun 2026 20:08:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456102; x=1781060902; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LZKzG1cjjYqCrg5ftXH0wOdwx3jBheILV4yoP9XwymI=; b=QYxgE5xUl5mcE9jXDuNnMYL4wZ3rXTFkuo4GRdwcOQvqT9HTIZMMXQ06k4D/6MZRPX Xz/+2hax99ZxH9LW4HeVc7Wb7kB699RcaYyfuHFch/dchz9iPG2c1TXOaZi5hx1WNCYg PuMvtdWRvDYtgVkMWAxkPengl73UHBqm9gt7rzMjJ6XTfeHPjRpth2JHDd9S8WmnzoqX CQ26Q6PDKRdNIT2KGJhFzm9yJD/YGrQkanKvAQGcDbbFAx1d/FmXlKfkPq8VcrfyKjRa NO4snquXlmL6zYdRvXWzTuy/a2GAMrS00xJ7v5LGCvpn73tEl4Slffc9+uK20KLnVL+i sZjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456102; x=1781060902; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=LZKzG1cjjYqCrg5ftXH0wOdwx3jBheILV4yoP9XwymI=; b=s7aRXr1T/HNxq2uc1LcMuYAcomg/3s/9y+MIWYHBKFKYPDuid4/lrqa6ICPleSc2/B qh7AIymbvkHwBKuUghcvNPeIZb+HAD9Uu91GWdgfH0Eed7T5xja+Px5oG2D1Yau/Otp3 y6QcHchDoWO3X50YHMTGjz0axu4+OdNyh3q76Rci19et9gdycwzc/yk8RokEUPMwsgRe w+tdvDo8/Xao6N6BVOTr/cRKjXQeAjuQ7TcMzRFbl4z3nPpNKHUe/K8B0nv0V6NKWoDl bZEgpwp2BzKO+aBM4WpvGAUqRsuYkP4V+kWK48mow1A2yinhFZtOVckFNwsIfW+mWTCf 6uCg== X-Forwarded-Encrypted: i=1; AFNElJ/5IcLKFz6Mk/nOASIjkMrIsEjwO8QhzBTUG3HsSuyyrMlBXKOYbfF1KBXWqdCjqjFyMJ6ETMizJoM/sUQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzdRPnLcOkzC5cOlGrenBqSu8IiXun8tEm2QfABziCEmvApkexH PLAG7eTeU2ET+HtuTqer/zBl3LE72QDvxOYse89ACx/Jjb87/7qhK6xO0MwfLsYP X-Gm-Gg: Acq92OEzxtkhExf5JDyYoKtKyrF/MnKD9jW2wQ9XYGDSORdlIEtQU3C7PRkzeNbxHaT qgwAETAoatU9Y8sncGRJXgghpvHIJsvKJtSe1ExxufeENoAipZH1BuhFAXTBURRFfQnUO0U/eoK w1vg/C4KNh6N+9W/UipoFAFsJ/Q2y6VulijyFwyqjqC5ByXNWklnwetx7cjZh8FCeJgyA0rG8Da O/2Uqz978m9DSrZtpmZzIVYCisxDEzf4icBsSWbaiyDN3SghvMXGOEUKQe90vKOgp9kv70ikynd a0ZjNvM+QP+VSVNos3uQEp+88IcLxaGElenZg1K6+dy6VPksQz9u8s4/0y5rceQY2KnDu7PS2ca GxaMPinlGNmsBbXsV1SgOhdTTwoNMAvXDDlV2+kdYSLN9RzBONMWoouGet/juIa8c0IrijTpvIM zLQtKL0PjMmo/PpvFzWQBDh66kUIN71hc8forDeR3KsAxxBMTU5dbP6Da4PfEVlQD85IJeiFeYG UT8H3C6YqBFL0GmtaEks3yFh4MXMc2s35H2rY8qk/tEkw== X-Received: by 2002:a17:90b:38ce:b0:36c:e254:4d5 with SMTP id 98e67ed59e1d1-36e306482e3mr1303320a91.4.1780456101691; Tue, 02 Jun 2026 20:08:21 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:20 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 5/8] dmaengine: ti: omap-dma: disable IRQs on probe failure Date: Tue, 2 Jun 2026 20:07:51 -0700 Message-ID: <20260603030754.288757-6-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The probe failure paths after IRQ setup free channel state while hardware interrupts can still be enabled. A concurrent interrupt can then walk lch_map[] and access channel memory that teardown is releasing. Disable IRQENABLE_L1 and clear irq_enable_mask under irq_lock before teardown, then read IRQENABLE_L1 back to flush the posted write. Guard the L1 accesses for legacy platforms where that register is not mapped. Fixes: 7bedaa553760 ("dmaengine: add OMAP DMA engine driver") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index cef4e3a38b04..61a935660341 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1811,6 +1811,13 @@ static int omap_dma_probe(struct platform_device *pd= ev) if (rc) { pr_warn("OMAP-DMA: failed to register slave DMA engine device: %d\n", rc); + if (!omap_dma_legacy(od)) { + spin_lock_irq(&od->irq_lock); + od->irq_enable_mask =3D 0; + omap_dma_glbl_write(od, IRQENABLE_L1, 0); + spin_unlock_irq(&od->irq_lock); + omap_dma_glbl_read(od, IRQENABLE_L1); + } if (od->ll123_supported) dma_pool_destroy(od->desc_pool); omap_dma_free(od); @@ -1828,6 +1835,13 @@ static int omap_dma_probe(struct platform_device *pd= ev) if (rc) { pr_warn("OMAP-DMA: failed to register DMA controller\n"); dma_async_device_unregister(&od->ddev); + if (!omap_dma_legacy(od)) { + spin_lock_irq(&od->irq_lock); + od->irq_enable_mask =3D 0; + omap_dma_glbl_write(od, IRQENABLE_L1, 0); + spin_unlock_irq(&od->irq_lock); + omap_dma_glbl_read(od, IRQENABLE_L1); + } if (od->ll123_supported) dma_pool_destroy(od->desc_pool); omap_dma_free(od); --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78D043E5A11 for ; Wed, 3 Jun 2026 03:08:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456106; cv=none; b=WKD1m55/A4XWs7BBU3vCbIHxlnTvl9AVk/4rqtqu12FnrFd1+mvria7kXD13zRxuQKx/jvuAnrQDa+Oaro9/FSTIaeEOwGia9ZSWI/UUYd8w0cBhSWd5Adato4Zo03C+FyTyaGgUs3FNyhyo6nFKsBETMBB04IywsUISDjaTGoI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456106; c=relaxed/simple; bh=UU+KzLESSp0kk4B2q1HC+6X1v604zjgC2rTFZxQX9f4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ioPrYlqijfPPE7nmhjXeI0YEWRk6nIia9l8d8APNTY5BDwSV/wfPRccmMIaIEd3ivJyv+wUNLq6xRJQUkeT9fNF3WTnxPYO1aJqFmUWk1Arln2+v9jXmcxfH/u+H5p7ak+TuB7vGexpkiEDW/38Vf3U+oyZmkKS23QtwpULFitA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OGl8ceDC; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OGl8ceDC" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-36da8439078so2686644a91.2 for ; Tue, 02 Jun 2026 20:08:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456104; x=1781060904; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hJVVrtusx/XpEEVdlLkuxUdKg7eDHMaqI+aWjwG9HdM=; b=OGl8ceDCBtlLCERK3ugdlfbuHCwGRae3xVXkKdyuFXLkvcn0Vd0SNbtZwmWAE5ylFY lqGExur9LRChbI8mXwnSFP2iLTYDNEUYYU5FrkeboLA6MsF/ztBilcgvGKdexwfY/TIN YWDQ4Pt7X8pLbkB6qQTv4hfosQleVTDgBjov0XU8OV+UULuENg9NDDQkPzKbaIyalUHL CsSQCYzqkrlt2E6p8tXD6tXB5Ks3bvH5c2uKlhWGNEiwafInq2SgSNrIJpYynUAFbzdU 5oL1MSfDqIaStX11z/r3gNrYlzka8LsMOuif0XvgMXoHcgTrteYsBNnhpZ3mwpqmKTjq o5QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456104; x=1781060904; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=hJVVrtusx/XpEEVdlLkuxUdKg7eDHMaqI+aWjwG9HdM=; b=YhUDPlRmEjzfq1aafk70DVZGxTMOM+zNf6gMnkLw6GDwa4XVf88DaF5OXvY/c7c9bv uTSNcv+lQWqjXXAkECYJn7vmKgaaZYEYrETdu6o96pg2FRsc92QYzJ7TBVMJGOlSx1GY l5q7DJQznuFZOpjeEIqIUQndgBdhD2hnzmmj9DSQSz39IpUjEXYElUx8f3ABUs5CG3wd E2/4Js6iuHVqeYHWEAsRIILlhJc86ZQPP3+folELiwaKg5M1ceTp73iX3FZpDSkqA3pv T5sdy1F26omq5L7iI7I+QRiIJqlmBzMvZZnMrywNaZEiOKT+qNw9MtLtL8ak0g/9W6TS T/Nw== X-Forwarded-Encrypted: i=1; AFNElJ9/7niqb7wNSuuqXlIskmdb3MV59iLgkVNQnDvkunoC3B/5Byd5ztO2jfS6Z46YOjgoX09hsXjlGsVHHrU=@vger.kernel.org X-Gm-Message-State: AOJu0Yz/rhC9W0BxJ1U24NLWazXcUgjbw9GeY3CfMG5R5TQ3bLjRRDf0 KZnVSzK/zsEFUBJaa+puoE4Fvxhtt542j0xrdLQrTCV4SHXq2EH4UZxo X-Gm-Gg: Acq92OGWNDraGffpJn2d7RB4RFM61kUCRBybt4RJ5tyxOJ/EU6kC78+6qOPZpfHy2KP M+AbtIxFFK5L5HWUIBjzIcQgkr0axqANuSHC+GuZQiQbnOza7lUlS6p3jjhJfQvab/gxd+Lt+4S lrUIjo88xeaLtgZloALqDX5XSB5hPV9/Zau0OnWM9BMsZ5UWWWt1MqfqcbKwjhvcbF316anEYFy 0xGkI95jqgzIGXDZUTIPUaK814gZLWm6ATY7iVyN3dszzGBrHtkVsEG/fifdlwqoGl6Guy6j9RU 930ad05kdhUkvSo2/JnoIcWS2IK0xkIwUKXtICjK90A6JZBDPuSAxIQadTOi4vXCjft1zVP1vGG j9Sz/aiyaoVkB/WMZWphW79sjGBG6V/XLA/xu8Nd6WRaLiceHBI5r0W3tl2mV2RdUkZUsK8HVEV UrHET4eLtUlB0rt/ce7sa+/BL055NjvM8hITsB/xEsC0otOfTbZkEq7k2oGMqjcLkvVxcxgdH4U dHVDGXGL48YhDEUbb71aXdkf7ff9LV0RTg4FIXBreoUXg== X-Received: by 2002:a17:90a:c887:b0:36b:293:68d1 with SMTP id 98e67ed59e1d1-36e30a29736mr1332510a91.16.1780456103709; Tue, 02 Jun 2026 20:08:23 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:22 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 6/8] dmaengine: ti: omap-dma: destroy descriptor pool last Date: Tue, 2 Jun 2026 20:07:52 -0700 Message-ID: <20260603030754.288757-7-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Linked-list descriptors are allocated from desc_pool and can be released from omap_dma_free() through the channel descriptor cleanup path. Destroying desc_pool before freeing channels leaves descriptor cleanup with a dangling pool pointer. Free the channels before destroying desc_pool in probe failure paths and in remove. Fixes: 1c2e8e6b6429 ("dmaengine: omap-dma: Support for LinkedList transfer = of slave_sg") Fixes: 2e1136acf8a8 ("dmaengine: omap-dma: fix dma_pool resource leak in er= ror paths") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 61a935660341..c0890d8c43ba 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1818,9 +1818,9 @@ static int omap_dma_probe(struct platform_device *pde= v) spin_unlock_irq(&od->irq_lock); omap_dma_glbl_read(od, IRQENABLE_L1); } + omap_dma_free(od); if (od->ll123_supported) dma_pool_destroy(od->desc_pool); - omap_dma_free(od); return rc; } =20 @@ -1842,9 +1842,9 @@ static int omap_dma_probe(struct platform_device *pde= v) spin_unlock_irq(&od->irq_lock); omap_dma_glbl_read(od, IRQENABLE_L1); } + omap_dma_free(od); if (od->ll123_supported) dma_pool_destroy(od->desc_pool); - omap_dma_free(od); return rc; } } @@ -1888,10 +1888,10 @@ static void omap_dma_remove(struct platform_device = *pdev) omap_dma_glbl_write(od, IRQENABLE_L0, 0); } =20 + omap_dma_free(od); + if (od->ll123_supported) dma_pool_destroy(od->desc_pool); - - omap_dma_free(od); } =20 static const struct omap_dma_config omap2420_data =3D { --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7F743E5ED1 for ; Wed, 3 Jun 2026 03:08:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456108; cv=none; b=saF+vT+TVnLdBy1NmV+N3ZfIQm/Q1dVjDf4h7THW/VXTtxlYSzQ1NWMqxtjooIFTSYH3qp4evOSkkqM8KzBwKldNcUOU5bqXEIK7hz9wSO06UXgwY0C8FoFXwOsc1XQannUnXLNI3mJGB6PYVHLkzCvu7OD9IrzuynAvdCEXXGs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456108; c=relaxed/simple; bh=GJjxv6I4KbyYJcLAYZXL2OfmKR11Tsw/rO82A+IHuJg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LVrilHQ1ozyGt3ubKjKzsnjL5y3QwOBKMV2mTmU0qEGt/7F+JWlJHCuDIc/JNceIJNQ+JS5YP/B+f7E9AuJIEI1xtqt/3MU9S/fzX7Z4AkK0rcr5PMaTalZEOhNq4z3nlSUhF14WUzgHgmq4VztCKtyxiwDiznC/mnqFkZGKLA8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jw0pT8eu; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jw0pT8eu" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-36b9033d230so89501a91.1 for ; Tue, 02 Jun 2026 20:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456106; x=1781060906; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=J/7UILlPUwdg4xP+wSM0nxIBSMKN8rKynfm10QKhZoA=; b=jw0pT8euhBc20d7qfmke4VEEebkcmILnxUNU9n52c65UWZD8ob2Se8y6DP9LLkXWIs F/3+yJqDI41I0CfHXVQJQ0rIWU2itiZOZe7OlDE+hFO7Y5+ai15w6GzTTKMCeZY4xG25 ZMK74Mn4nomYfUU+3I7AEuLdUHKnzrfDWmDeFl/PpdwRkMo/5jmxGC6HZbufQ+1KWQZF JkO9kZS93mQVX/etLE1mgdrMTRzqgDARG30amxZQxJqUPcNMgXC6Jgt5tVi+B3NWP5qU O2IXzxcULxO0brAVkBSkNw+gwQ2jp4BlpfENIo1PpiRFQ79BSBR+llV5SDX6311E7TeE LI3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456106; x=1781060906; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=J/7UILlPUwdg4xP+wSM0nxIBSMKN8rKynfm10QKhZoA=; b=S2TOVfEeJfgtOfigMm5oe7lNlGWbo5jKDrD015/UJdx4oWK86Mlj9GihumUuvgAkH8 rp7pJyp+eZGymh/fAwANvD4NisasMBTeA5R6E163VyjfxtTTTanVEJ0/flCwcG2NkkPZ jlmzfkQ8ifgByjaostLGVESUO6gTYP9cv5YABMxQtiIQT1xlJAb/FzxKVb/LXByXWSz7 yvb8jIAsioi+2g/oVCJdGHyuw0PW5av/FNuX3ZGfPfjIguCObYcyG8bStyGAtt8R63Lj vkzSOpUTtmkwubKbCrv8s8IUGz5D8h7ZkGLcyAsnsFuhE+2v7NJii7xG9OXPl4fsdmKG bkcw== X-Forwarded-Encrypted: i=1; AFNElJ/c/XFLLGbOISmPiAyfJZI2lc0VVfzbKwppZDkDK1h/0PwkKmnLzhHvYqLMZBguxnrDZjk8esL04mM7ZjA=@vger.kernel.org X-Gm-Message-State: AOJu0YwmJPOljIsbNwa45eF8IM4oU+xE/ux+322HLBQJf1+pFuOlvqQE YCD2c3qCwgbsLLyc22qWwC3m66J4rZ9kEVx8yOEpEXUr4XvDCqLV4j1/ X-Gm-Gg: Acq92OHRm0XRKMoDA4YXJk43SDRkTfg/ozWDrCMydqP603MGK+6AUfTMlMmK5HUDViy ioxp09g7d0v18Eg9wQ6C6N8exwL1TCZXiXVddFi+I46LTMFI/vWKhwpgMAAB0a+LLddPqqNe+zp qRplAAAffnO3pczfV263A2TFi+J2nwc0LU0k+KPtPur5qnwuGzYa+Q/Xy+nydt2T4MJT/HmWk/C zOY0nHraVaCQ9r9S5PYseS4AG4F69qQOyZAPNR3LsOloB31+qvHehrmQ3lEfp6QJoHRG+m8fOBf vs2U4KhligM2a96Mor+RBThaaP2Krd5L2fU2NRNY6m1s3B2RVnQ98uoGLwtr4lQFmMdj8vD0Kk/ pOfBYmivQh3/+xa+cav5gRKgrOtjRD6Wth+/HaCnyuM+JXTK8sxdUto5k3M+rPyXcDY6NYHBVT5 I//EW13BZOu5hzoGTiH5DqwYJASpkSbQdUMGiIeGKlv0zL5NUGpPg7Q1zXO16Be9PsMwCAcBiFT nEAOnBGdBbFzP5IVM0fTg3Je86bX984QaB96dnVVljzbCWupn0jIjCy X-Received: by 2002:a17:90b:4c4a:b0:36b:8e97:fb06 with SMTP id 98e67ed59e1d1-36e3a0f4ebdmr1048567a91.8.1780456106063; Tue, 02 Jun 2026 20:08:26 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:24 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 7/8] dmaengine: ti: omap-dma: fix interrupt handling in remove Date: Tue, 2 Jun 2026 20:07:53 -0700 Message-ID: <20260603030754.288757-8-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The remove path had several pre-existing bugs: 1. Interrupts are enabled via IRQENABLE_L1 in probe and alloc_chan_resources, but the remove path writes to IRQENABLE_L0, which has no effect on the L1 interrupt line. The DMA engine can continue asserting its IRQ during removal. Write to IRQENABLE_L1 instead. 2. devm_free_irq() was called before disabling hardware interrupts. With IRQF_SHARED, the hardware may still assert the IRQ line after the handler is freed, causing unhandled interrupts that can lead to the kernel permanently disabling the shared IRQ line. Disable interrupts first. 3. platform_get_irq() return value was not checked before devm_free_irq(). If it returns an error code (<=3D 0), passing it to devm_free_irq() is incorrect. Add a guard. 4. Clearing od->irq_enable_mask and writing to IRQENABLE_L1 raced with the interrupt handler, which reads irq_enable_mask under the spinlock. Hold irq_lock around the disable. 5. The posted write to IRQENABLE_L1 used _relaxed accessors with no readback to drain the write buffer. Add a readback flush before devm_free_irq() to ensure the hardware has actually disabled the interrupt line. Fixes: 2e1136acf8a8 ("dmaengine: omap-dma: fix dma_pool resource leak in er= ror paths") Cc: stable@vger.kernel.org Assisted-by: Opencode:BigPickle Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index c0890d8c43ba..7343325ce2b1 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -1517,9 +1517,11 @@ static int omap_dma_chan_init(struct omap_dmadev *od) =20 static void omap_dma_free(struct omap_dmadev *od) { + struct omap_chan *c; + while (!list_empty(&od->ddev.channels)) { - struct omap_chan *c =3D list_first_entry(&od->ddev.channels, - struct omap_chan, vc.chan.device_node); + c =3D list_first_entry(&od->ddev.channels, + struct omap_chan, vc.chan.device_node); =20 omap_dma_terminate_all(&c->vc.chan); list_del(&c->vc.chan.device_node); @@ -1878,16 +1880,20 @@ static void omap_dma_remove(struct platform_device = *pdev) if (pdev->dev.of_node) of_dma_controller_free(pdev->dev.of_node); =20 - irq =3D platform_get_irq(pdev, 1); - devm_free_irq(&pdev->dev, irq, od); - dma_async_device_unregister(&od->ddev); =20 if (!omap_dma_legacy(od)) { - /* Disable all interrupts */ - omap_dma_glbl_write(od, IRQENABLE_L0, 0); + spin_lock_irq(&od->irq_lock); + od->irq_enable_mask =3D 0; + omap_dma_glbl_write(od, IRQENABLE_L1, 0); + spin_unlock_irq(&od->irq_lock); + omap_dma_glbl_read(od, IRQENABLE_L1); } =20 + irq =3D platform_get_irq(pdev, 1); + if (irq > 0) + devm_free_irq(&pdev->dev, irq, od); + omap_dma_free(od); =20 if (od->ll123_supported) --=20 2.54.0 From nobody Mon Jun 8 06:36:17 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DD833E7BC5 for ; Wed, 3 Jun 2026 03:08:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456110; cv=none; b=V6q7lgiyIMIcDdljWX0B3Qcc4oOylYpixArPeWw5oOoO8P6SD6KS9M5c5Zt3A+Upa5nUJ89BH2ClgUaHx75Nh2aM3PL3TFmFKv7kjnk12Lt2HmMHcIQyGg7Kc37nZ+p2R2FLsipjG1K3AXLm40Ye88C53bA2Nkqz+JzVqdNVWMg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456110; c=relaxed/simple; bh=34Zm3W7woqTMi8w3X3JA5sjumybeyKNHi38eRAQVT+w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KlHJPceutKFdFQHwdWhx5q79sG04b0aGDNiPfhd5stqCmltzcgGS7DQ9Di7zI+Az1q+zT17BOrow3sA4w9iFo181dkR04stzTKgkICii13JDizyxs97CXenczG/bfW9K/erF92Paaorpa7qocDnhksXyfVK9Vqk+R2qHgAAZuNA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AkJj2lKP; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AkJj2lKP" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-36dac5d5d05so1412425a91.2 for ; Tue, 02 Jun 2026 20:08:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456108; x=1781060908; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=USwZ93J2NNYew7Ti1RVaXMO67Ur9p4DSXE1j33WNuVA=; b=AkJj2lKPM8B0v0YonJE34FMtNClizjxYTrInkqFDett8hGvPe2Tc7Wk9jcsjdF9xpE 90eJtXS2owcBDYj5+9h/nYlwhXXfPUJyzPfkNUJhs9AoL5WbL/5LBmSq15kCwgCwIgoR 0MAPkm4TdSMFgsh7h+bsEw5s1sOpnqr0+d6BWBK3vYtGoZomy0EDS9Z9fgf4SRZSQ5BT 8rTsmBfL/GdTv1Eby6GXi9h628uq1JlC9N3kdoqxSguLw9tWqxStaw76h27HYhPg/+ZR hyJd0oTYjdk6t+nc3ZiX2kLJwy9B0SBHRnxEgb+ZAbcJ3UCeLH0xGi1KGA0Tg+ezkixQ 8eyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456108; x=1781060908; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=USwZ93J2NNYew7Ti1RVaXMO67Ur9p4DSXE1j33WNuVA=; b=Y2LD5HEgmejE7MKc0VljlDjArEUa8eAdekpqRMNgZnq4F2LgRoZd2h6HSRpykRc7A9 X9/hJkle/0KANqHI06C6n/Dr0txk4OGm8E0hNCAHBhvbk5tc7UqlKOSH3N692SizhyVi llmXs/GR8qFYP7ff1kk2A3eibTZOSp8LGInTqFsdfs7eUvbs6PoQ4WT6WdntIGsegnhh xi5z1tMPYn2LgCTQ3TZk174+S80eO45aWLbnZm484Eik8wr5ZVrTDO+ZC8D47pdKkt7w llUT+TEm4e2iFaFm9BZH3qSw3eZxPH45zrmNmbZWBnOCR02tNQoo3aZNrlm8rBSVjSgy o2qw== X-Forwarded-Encrypted: i=1; AFNElJ+WhyLsDia9hpb1JNLf1h8V+sLpjl9Zj/kePJg2NgTvv/zJTzkDoRt/6v3HA8ZQWT94vCvapijdBQEZWWQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yw3QCAyBs18gdg1oMncmpcA4T8QnWa0PptdqnfgfZmp0L3Sl5Db irfG2SHROOvyF8ZdJRrlALCgjJgkXDQBx1oUzN8L3uopGsiyTVPFMUe/olldMqwL X-Gm-Gg: Acq92OEbkNAxl8SvRQBftzULWR3ZbhfDz0HhJN0Cggt+bf7KE5zosxgp0+m1hSNzvXP Sqaj2XBD4l6qBClDdICY0koZBCPRajrnWaAz861WDqviR/7evNkvkDQUV2IuFf+FrIQh86Ssynu 4mDMrBHy7k7mKA8VRL0QBCvXY2QJw5Tle49ZHVFAOaMbEj5pE3X1/9vW6AKK6CHIQtAd9mHfzZq sT7SF3daSI5wcg7WjAo1hsJfX0nKjTrzZt5n4+rZEIHFEqZRn3py53iA2rnXQEsiv86E6Q0mnNa XMdyTxtIolJVNqmBKzbNMofe6bS/pESMWWK8yT21Ic2rVv2dfrdJN5q7a+Oo5bcY0+h6XbhU960 BWWff/ug1ckIJX2shdPaOWgrW0nrYiauYkhBVnjmWaJqDojo2jEis7TCHk1zWMGHUCnMBAvvY1E RvY8zRIMEOjr7Xw9Mj7ZCNS/Yx0m+/RG+4aRkx2Wbyc3WQDLGDndL+4BNvGWgdrAaxX2xgZ5bNW TwWBmqQfk/OCI90CZJFCHNL9wB8Ct9ca/EMBs4a5WV8ow== X-Received: by 2002:a17:90b:1c0a:b0:369:7f25:cec0 with SMTP id 98e67ed59e1d1-36e2dc53790mr1396861a91.0.1780456108116; Tue, 02 Jun 2026 20:08:28 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36e0a186741sm1247102a91.8.2026.06.02.20.08.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 02 Jun 2026 20:08:26 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Peter Ujfalusi , Vinod Koul , Frank Li , Kees Cook , "Gustavo A. R. Silva" , Haotian Zhang , Tony Lindgren , Russell King , linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be|_ptr)?\b) Subject: [PATCHv3 8/8] dmaengine: ti: omap-dma: turn lch_map into a flexible array Date: Tue, 2 Jun 2026 20:07:54 -0700 Message-ID: <20260603030754.288757-9-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260603030754.288757-1-rosenp@gmail.com> References: <20260603030754.288757-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Convert the separately-allocated lch_map pointer array to a C99 flexible array member at the end of struct omap_dmadev and annotate it with __counted_by(lch_count). The probe is reordered so platform_data lookup and the lch_count determination happen before the parent allocation, letting struct_size() size the FAM and the dedicated devm_kcalloc() for lch_map go away. Two allocations collapse into one and the runtime bounds checks from __counted_by now apply to every lch_map[] access. Assisted-by: Opencode:BigPickle Signed-off-by: Rosen Penev --- drivers/dma/ti/omap-dma.c | 72 +++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c index 7343325ce2b1..dab600604572 100644 --- a/drivers/dma/ti/omap-dma.c +++ b/drivers/dma/ti/omap-dma.c @@ -49,7 +49,7 @@ struct omap_dmadev { const struct omap_dma_config *cfg; struct notifier_block nb; struct omap_dma_context context; - int lch_count; + u32 lch_count; DECLARE_BITMAP(lch_bitmap, OMAP_SDMA_CHANNELS); struct mutex lch_lock; /* for assigning logical channels */ bool legacy; @@ -58,7 +58,7 @@ struct omap_dmadev { unsigned dma_requests; spinlock_t irq_lock; uint32_t irq_enable_mask; - struct omap_chan **lch_map; + struct omap_chan *lch_map[] __counted_by(lch_count); }; =20 struct omap_chan { @@ -1661,36 +1661,55 @@ static const struct omap_dma_config default_cfg; static int omap_dma_probe(struct platform_device *pdev) { const struct omap_dma_config *conf; + struct omap_system_dma_plat_info *plat; struct omap_dmadev *od; + u32 lch_count; int rc, i, irq; u32 val; =20 - od =3D devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL); - if (!od) - return -ENOMEM; - - od->base =3D devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(od->base)) - return PTR_ERR(od->base); - conf =3D of_device_get_match_data(&pdev->dev); if (conf) { - od->cfg =3D conf; - od->plat =3D dev_get_platdata(&pdev->dev); - if (!od->plat) { + plat =3D dev_get_platdata(&pdev->dev); + if (!plat) { dev_err(&pdev->dev, "omap_system_dma_plat_info is missing"); return -ENODEV; } } else if (IS_ENABLED(CONFIG_ARCH_OMAP1)) { - od->cfg =3D &default_cfg; - - od->plat =3D omap_get_plat_info(); - if (!od->plat) + plat =3D omap_get_plat_info(); + if (!plat) return -EPROBE_DEFER; } else { return -ENODEV; } =20 + /* Number of available logical channels */ + if (!pdev->dev.of_node) { + lch_count =3D plat->dma_attr->lch_count; + if (unlikely(!lch_count)) + lch_count =3D OMAP_SDMA_CHANNELS; + } else if (of_property_read_u32(pdev->dev.of_node, "dma-channels", &lch_c= ount)) { + dev_info(&pdev->dev, "Missing dma-channels property, using %u.\n", + OMAP_SDMA_CHANNELS); + lch_count =3D OMAP_SDMA_CHANNELS; + } + + if (lch_count > OMAP_SDMA_CHANNELS) { + dev_err(&pdev->dev, "invalid dma-channels value %u\n", lch_count); + return -EINVAL; + } + + od =3D devm_kzalloc(&pdev->dev, struct_size(od, lch_map, lch_count), GFP_= KERNEL); + if (!od) + return -ENOMEM; + + od->lch_count =3D lch_count; + od->plat =3D plat; + od->cfg =3D conf ? conf : &default_cfg; + + od->base =3D devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(od->base)) + return PTR_ERR(od->base); + od->reg_map =3D od->plat->reg_map; =20 dma_cap_set(DMA_SLAVE, od->ddev.cap_mask); @@ -1735,19 +1754,6 @@ static int omap_dma_probe(struct platform_device *pd= ev) OMAP_SDMA_REQUESTS); } =20 - /* Number of available logical channels */ - if (!pdev->dev.of_node) { - od->lch_count =3D od->plat->dma_attr->lch_count; - if (unlikely(!od->lch_count)) - od->lch_count =3D OMAP_SDMA_CHANNELS; - } else if (of_property_read_u32(pdev->dev.of_node, "dma-channels", - &od->lch_count)) { - dev_info(&pdev->dev, - "Missing dma-channels property, using %u.\n", - OMAP_SDMA_CHANNELS); - od->lch_count =3D OMAP_SDMA_CHANNELS; - } - /* Mask of allowed logical channels */ if (pdev->dev.of_node && !of_property_read_u32(pdev->dev.of_node, "dma-channel-mask", @@ -1759,12 +1765,6 @@ static int omap_dma_probe(struct platform_device *pd= ev) if (od->plat->dma_attr->dev_caps & HS_CHANNELS_RESERVED) bitmap_set(od->lch_bitmap, 0, 2); =20 - od->lch_map =3D devm_kcalloc(&pdev->dev, od->lch_count, - sizeof(*od->lch_map), - GFP_KERNEL); - if (!od->lch_map) - return -ENOMEM; - for (i =3D 0; i < od->dma_requests; i++) { rc =3D omap_dma_chan_init(od); if (rc) { --=20 2.54.0