From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AB2C3A8739; Tue, 21 Jul 2026 16:10:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650205; cv=none; b=b0GZvNSZ0WnH//yzHCt/POLbw1zCPW06pLrEGRIV352FJwOIv/6vg3U6SjkX6pIUvPYcaaHh6wUek73XDK6Fk4GitnvqHDaBV3BzmkAdMwErjK3MY/ePhFCmb12hAAOOUskV+lu8A/SbQZKfV4HGVHYooZNzBaNI8Vj+V8dXips= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650205; c=relaxed/simple; bh=/bHx1KqUQ5FZegJF2+0lqfCDtUh0LCnmdvxhqwVny8s=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=ZHT8WvzR/xjBdCjMdYm+GEi/dpD/UatNbn0h7Wptgi+rCZRP+/hMG8wvZGxk5lZmyL8vr51dC/yKzdK2cIREgpWOM5uTmctMdM1I8YSBC+0VwGIbSwad2JWsgW7dcrDC3d7xel8ZsBQxTPjop1WFnRaxAMcnMC8adRYTrUHccIA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=UDVrnMRq; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="UDVrnMRq" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=1Sc00LLbJ3B9EzEYCBr4PK/7bI/kLf3dvLcEogNQeHU=; b=UDVrnMRq69XtJCsImi2wVuvH+n 90Lw+g3FpD2ptOEgsLzgSuToFDcV9m8d0/KKYAHLCvv+rKH0SOanRCM053MptTSU8cooSw1q1nkrr z5fCUMAdsKwhUmnlI7i5EJvPiczkovi6s6KxARfZ1MZY8jr/CivtUBf5hHNwPTC9ZUjMR7qW9z9OV bs7nPtnCvHt59wuASjljARz/VbQ/qiIGKDVHZnjRQxD4/PsXFZ6s0uPb7AEB+aRjvivSId63uhc7x N4Ho7oN0xH/LpNjOo3CggyAujUlYoTGXlkyJGRHiD7eXo4oxKW7o2H4TdqqQS+RK4Jek4V2eZgsIa b2Mpytdw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD2Y-0000000BodK-1fBB; Tue, 21 Jul 2026 10:09:55 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2T-00000000GBK-34Y3; Tue, 21 Jul 2026 10:09:49 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe Date: Tue, 21 Jul 2026 09:57:28 -0600 Message-ID: <20260721155739.62120-2-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 01/11] dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_free_desc() frees swdma_chan->hw_sq, hw_cq, and every desc_ring[] entry without clearing the pointers afterward. If switchtec_dma_alloc_chan_resources() fails partway through and calls it during unwind, then a later retry of alloc_chan_resources() fails in switchtec_dma_alloc_desc() before reallocating one of those pointers, its own failure path calls switchtec_dma_free_desc() again and frees the same, already-freed pointers a second time. NULL out each pointer as it's freed so a subsequent call is a no-op for anything already released. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 3ef928640615..a4a7d66d042d 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -886,14 +886,18 @@ static void switchtec_dma_free_desc(struct switchtec_= dma_chan *swdma_chan) if (swdma_chan->hw_sq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_sq, swdma_chan->dma_addr_sq); + swdma_chan->hw_sq =3D NULL; =20 size =3D SWITCHTEC_DMA_CQ_SIZE * sizeof(*swdma_chan->hw_cq); if (swdma_chan->hw_cq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_cq, swdma_chan->dma_addr_cq); + swdma_chan->hw_cq =3D NULL; =20 - for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) + for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) { kfree(swdma_chan->desc_ring[i]); + swdma_chan->desc_ring[i] =3D NULL; + } } =20 static int switchtec_dma_alloc_desc(struct switchtec_dma_chan *swdma_chan) --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A359046C4B5; Tue, 21 Jul 2026 16:10:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650204; cv=none; b=qbsnwy6yZi5VvT8l0tNyMKMRspOsGrRqb7a+4ZoaqNcwg/tcO3ld2IKSNWEd6xxAwcb1ptSDcKZ9A3wbwcS79/p/y8T0HHIn/a7jKwCKeDSVP7LXgJhhXUCvPjduo5/PdsuQw6tGMibSi7EHnRwD8qKSfuRA9cFkQF2UrX5nPqM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650204; c=relaxed/simple; bh=FVhU2O5KAG3SHcSUCG+FnL2Wzb62sVaf/pLucCUa73E=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=MMvj7l3kviy6MDoEYt510/xjghM15Du7o5cQ9acCW88JCMvMHj1ck5GoNEZUi1mIQAnR1MHifXyUwDc+QaxeQkUHfFtRUGUFDOpy1mWHHccD6iYggmRj2wFm5usUfx1K3CL82c/oCQNbAF9H0eK4RfLYQcPIwv8nfzRgSojB4tA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=FW6UG6kO; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="FW6UG6kO" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=k6zDZcRGu69Ez1a33wMHmomvl1NaiSYymwqknUwINQI=; b=FW6UG6kOLkdHTP64UzVnXiTlO6 iWgKpX1V4SaReiN18s0HONocEXkpqdn2JKIOrsRJlTmVYKx7QB/PnkNEHVtIco/lEDalocIFV8/C9 tC6dCPyFyOvVUUwjt6BhQdoe2ZRvkY/+6eqP5o+1V5lOaxGAtbNgon97dQivLyAxvNWtMOfhUQY20 2ubfTktu0/mxct42YwR6ZQiJ9JaWmDyIx6u7FX6NhpuvaQXlra3u9ENKVkba7SZ1sYevxDXIXqYX6 XfNl7JPSQF+u6Dxzg10buw/S2XSURP5FkCa2ibmk/X0n7Ki1B0Y+TkG7JQZfQGwnWJ9FdVl4cDXY2 4KLf66nA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD2Y-0000000BodL-1gLz; Tue, 21 Jul 2026 10:09:55 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2T-00000000GBO-3fxe; Tue, 21 Jul 2026 10:09:49 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:29 -0600 Message-ID: <20260721155739.62120-3-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 02/11] dmaengine: switchtec-dma: fix resource leak in alloc_chan_resources X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_alloc_chan_resources() returns directly on any later failure, without ever freeing the descriptor rings and coherent DMA memory it just allocated. The dmaengine core does not call device_free_chan_resources() when device_alloc_chan_resources() fails, so the driver has to unwind its own partial state. The device-removed check also runs after ring_active and comp_ring_active have already been set true, so a failure there left the channel marked active despite alloc_chan_resources() reporting failure. Add an error-unwind path that disables the channel and frees the descriptor rings on every failure after allocation. ring_active and comp_ring_active are cleared under the same locks switchtec_dma_free_chan_resources() already uses, since the completion tasklet checks comp_ring_active under complete_lock before touching the completion ring, and a stale IRQ can still be in flight when this unwind path runs. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165555.350951F000E9@smtp.ke= rnel.org Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index a4a7d66d042d..f77da31aeb65 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -988,15 +988,15 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) =20 rc =3D enable_channel(swdma_chan); if (rc) - return rc; + goto err_free_desc; =20 rc =3D reset_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 rc =3D unhalt_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 swdma_chan->ring_active =3D true; swdma_chan->comp_ring_active =3D true; @@ -1007,7 +1007,8 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) rcu_read_lock(); if (!rcu_dereference(swdma_dev->pdev)) { rcu_read_unlock(); - return -ENODEV; + rc =3D -ENODEV; + goto err_ring_inactive; } =20 perf_cfg =3D readl(&swdma_chan->mmio_chan_fw->perf_cfg); @@ -1029,6 +1030,20 @@ static int switchtec_dma_alloc_chan_resources(struct= dma_chan *chan) FIELD_GET(PERF_MRRS_MASK, perf_cfg)); =20 return SWITCHTEC_DMA_SQ_SIZE; + +err_ring_inactive: + spin_lock_bh(&swdma_chan->submit_lock); + swdma_chan->ring_active =3D false; + spin_unlock_bh(&swdma_chan->submit_lock); + + spin_lock_bh(&swdma_chan->complete_lock); + swdma_chan->comp_ring_active =3D false; + spin_unlock_bh(&swdma_chan->complete_lock); +err_disable_channel: + disable_channel(swdma_chan); +err_free_desc: + switchtec_dma_free_desc(swdma_chan); + return rc; } =20 static void switchtec_dma_free_chan_resources(struct dma_chan *chan) --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7ACA046A5EE; Tue, 21 Jul 2026 16:10:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650205; cv=none; b=jZat+aXaykE9qpEMspqJfyBAxB4Rv35wXKBiW7H4ANWxfkSqpw32f4CS6fdjwytAQkzGGo8ABRINeQMLPxDM/FQS9ykB7vQ25YB0qrdhV/DrwWLXVd93hHh/iedZ8dKe16XKx6NaP6T9J480OMmwm5HnoedF8BQJRTOXouQGo+E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650205; c=relaxed/simple; bh=OXiPslDd2o9nSTRGWT1ePajAd8DDFmGsNGGdCZU8e9M=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=AneKgjJe+QPJiuHhO/nUndbH13XVZ2NpD9DNJMzhKsos9b4F8PvSiScyXrmm7vfpnPQDX4hmzn090NdGc/TbCARQOVJFeInn/L/u+Jw5Oc5OOCx2VJw/XZJMUKaFFiEmRFOKS94pqeSvBK8hfBZnPbtjZd1sXLCvKK9QgKxETJs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=q/A3u276; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="q/A3u276" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=SeOtga1zPuUE5+/HFLKP8aGr+Bai6ulg3V4WQ65UbGo=; b=q/A3u276HaU1DMGldNayGZuFc7 I7WC7X/LeLldKaV87OJkNXn7jN2bwAyhI8o3iHiumqGCPKU1DnMASpD/594hrHk9PC2g6f3EUMLb0 l9FlzC04Tfv1afvr4Ed+BKsCFgXP8Eww1VxdNAV1Dbjae/Il/xtB+o9IsFM3lUT6O8kkfpdAAaUHz rnkM+gM/+dreBLLBhPw/NvDeBBYpikONDjtXSfHWL0rWWrqcU9FEsvvOk3g07R8ILvDd+CZ//ircC sFpFNGO+Xqf9A97DlaYqHDTp4kt+asTiiz7TVbeLzodr5I9viNnGJ03gnpOs+Yzi2cOc4aveIL8hu woqMw4vw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD2Y-0000000BodM-1gKO; Tue, 21 Jul 2026 10:09:55 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBS-09zh; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:30 -0600 Message-ID: <20260721155739.62120-4-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 03/11] dmaengine: switchtec-dma: halt channel on alloc_chan_resources error X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" The error-unwind path called disable_channel() before freeing the descriptor rings, but that only clears the enable bit with an unflushed write -- it doesn't halt the channel or clear its DMA base address registers. If unhalt_channel() timed out, the channel's actual state is unknown at that point, so nothing guarantees the hardware isn't still touching the rings when they're freed. Call switchtec_dma_chan_stop() first, matching what switchtec_dma_free_chan_resources() already does before freeing descriptors on the normal teardown path: it synchronously halts the channel and zeroes the DMA base registers. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223647.F0A051F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index f77da31aeb65..107769cca772 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1040,6 +1040,7 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) swdma_chan->comp_ring_active =3D false; spin_unlock_bh(&swdma_chan->complete_lock); err_disable_channel: + switchtec_dma_chan_stop(swdma_chan); disable_channel(swdma_chan); err_free_desc: switchtec_dma_free_desc(swdma_chan); --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60D8A46C4B1; Tue, 21 Jul 2026 16:10:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650204; cv=none; b=NIC9K4OEuK+LU0T3D+eUS+ojzcN50oWCCNEUrvav50kU1c/DubCQXWPy5dMZBwu6wgiI4xnKAXKYfqEYWwS+9kyFp90vC6id0Q4KUKgwfyHKJ7Ka5bwnKPDto3K+QBEfTi04525V7TmuuMAzTozHrCH7J1GNqNQazUp65Fik7lc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650204; c=relaxed/simple; bh=xYBVJJnXMeuICfOQTBJT12XhDDBX7WyKQarCranQQ3k=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=mEGhc3p3PtNQdPBo+ShSZZRjuampVT0XUqmHP1iAl1wOqSO7sWutwlVS+xMNMISjtErN7vlD+REQUj9pNZLp0bJjBNwanx4oKg0LLOcmeTYPJgq90FA+87BU83SRT5qbNwnv2WvSK30loUQlJnt0pOU2OA/msDf4+mgIJGKyGh0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=Vuqtkzl/; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="Vuqtkzl/" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=h36/TpXU9q+PWeF7/dwaoGjY5yGAXiWA4lA7d9GhSrk=; b=Vuqtkzl/OGbGozS2nrv++GaJJO 15AcIySaXqYg20NER5rbNx7eEpNdg1wUfCbPX6f5aKSPhVx7drR6lAQk0hbUCItjjO/gl0QRzqCHD dIstg2PGxtbXnvxii3uJIHJKWJK3gSs3dH3UUQGvyBkQtzKmd5PUGZ0ifKNCdxZUg+vzM/FTFcGtg XtUFr2IyjrUhwUuk9yYNkgVuYyzk9ihhurnFb7sqE6VRJVfq3cslr2Tce2klRB6knYFJgIVVHiiWK xqmyQkmgsvON7AM7ThBcUQ/h1QdOfRxFXrDOL9hLLkgZOSxoQqxNIq4IxSZZQN4w3eFBVqYwlgUr/ aaFIxrgA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD2Y-0000000BodN-1gKC; Tue, 21 Jul 2026 10:09:54 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBW-0f1P; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:31 -0600 Message-ID: <20260721155739.62120-5-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 04/11] dmaengine: switchtec-dma: fix channel leak on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chans_release() is called in three places but the underlying memory is not freed in all of those places. In order to clean this up, introduce a switchtec_dma_chans_free() helper that will free the memory. Ensure each call to switchtec_dma_chans_release() has a corresponding switchtec_dma_chans_free() call. (The release in switchtec_dma_remove() pairs with the free in switchtec_dma_release()). swdma_dev->chan_cnt is now set to the number of channels that succeeded when one fails to initialise, so switchtec_dma_chans_free() can still be used if not all channels succeed in being allocated. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223024.9BB8A1F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 107769cca772..13efd4189bbb 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1176,6 +1176,16 @@ static int switchtec_dma_chans_release(struct pci_de= v *pdev, return 0; } =20 +static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) +{ + int i; + + for (i =3D 0; i < swdma_dev->chan_cnt; i++) + kfree(swdma_dev->swdma_chans[i]); + + kfree(swdma_dev->swdma_chans); +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1201,7 +1211,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, if (rc) { dev_err(&pdev->dev, "Channel %d: init channel failed\n", i); - chan_cnt =3D i; + swdma_dev->chan_cnt =3D i; goto err_exit; } } @@ -1209,10 +1219,8 @@ static int switchtec_dma_chans_enumerate(struct swit= chtec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: - for (i =3D 0; i < chan_cnt; i++) - switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 return rc; } @@ -1221,12 +1229,8 @@ static void switchtec_dma_release(struct dma_device = *dma_dev) { struct switchtec_dma_dev *swdma_dev =3D container_of(dma_dev, struct switchtec_dma_dev, dma_dev); - int i; =20 - for (i =3D 0; i < swdma_dev->chan_cnt; i++) - kfree(swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_free(swdma_dev); =20 put_device(dma_dev->dev); kfree(swdma_dev); @@ -1317,6 +1321,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) =20 err_chans_release_exit: switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 err_exit: if (swdma_dev->chan_status_irq) --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD9873E49F3; Tue, 21 Jul 2026 16:14:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650473; cv=none; b=JH2jI2OAatUjmK3J7CA4cmm2Cn+GpYWOvCXA4ziQpTj1onRt3O885fRSVLxNsSxP0qwuuxFUD4OzisIXFZdUnKuVIFFzY8WaP5mwQPq9az0jAeD/nk9FdAd1Ynu7fFiNhxDT48kXxip/YjEs4XWFVmS0LNpV2h0jtTH6NUdtajQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650473; c=relaxed/simple; bh=20sFKIOV73SBHpBws1RS5gEwO3oT+vqTi8D303PL8A8=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=nqagy5MxU8M2ZJYH0p31STXwEVg5pMsj9iytMFJiiXX86Cw42rUmRGrgRueqO3D7PbJeZYMQnWXOrrUt3snZlJxGC7Dd2RHWEX64IyniTsGX+j/teDaXMQAKjWJs42w4EMm6Pypzd9qx2zLfNAzrRhht6nBkJPPppA0w1gqVmsc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=oLjO88ZD; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="oLjO88ZD" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=FwAPv8BwAGiRQ4GI/TwrEVyVgOh2IxmuzKiZ1T/BXY4=; b=oLjO88ZDnuNo9T1r536QRCm6j+ K0NwxmAwVWiFgVDNrizqxKYb7pnbSn3cMaH1vtTv9vuTJdnDqLsl6pZpwwCSQ9xix6h35KBF3sxfq 2p7vzUq1RQmVKQ3c10x3z9AbmI7sHKXoLvhK2Na+1yX813A0K6Ck672kM5z9uuSGIvID5N6e3+uVR cqyN3joyQSA6DbAkzEEPaKrJlEe5k1m9E0kNnii3NSUckvuOPF5VAhGRBXQcCQLlJS2IVag3lvfJU 5/CCY02D65ulxfDjVy7NNPeXCF8fVbd1yfIXXguWNJVQG73XrdUD3GK0md3g0W7QE3EGeT/ZQx/e2 70p7dqWw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD70-0000000Bogv-1UFJ; Tue, 21 Jul 2026 10:14:30 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBa-1Jbi; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe Date: Tue, 21 Jul 2026 09:57:32 -0600 Message-ID: <20260721155739.62120-6-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 05/11] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" It always returned 0, and no caller checked it. Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 13efd4189bbb..c752a1b05871 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1165,15 +1165,13 @@ static int switchtec_dma_chan_free(struct pci_dev *= pdev, return 0; } =20 -static int switchtec_dma_chans_release(struct pci_dev *pdev, - struct switchtec_dma_dev *swdma_dev) +static void switchtec_dma_chans_release(struct pci_dev *pdev, + struct switchtec_dma_dev *swdma_dev) { int i; =20 for (i =3D 0; i < swdma_dev->chan_cnt; i++) switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - return 0; } =20 static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 513393E49E5; Tue, 21 Jul 2026 16:14:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650474; cv=none; b=G0XcQoKNgPytmk61oInmHI77A44ZjudymwdgJ7eYLewI3dQehQEwjn9oAl81dbWljIbbnY4dlQkgOqFM67KlKJq5R/RVLFjnC0J5oOI67dV6PA5jw4uKsmY+Cf1ktcBv1L18D5K5mlYME+hRzuojlNBBY0n0dlwn+W6Yg8/1yTo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650474; c=relaxed/simple; bh=xQHe7eXkeemYxcNswwPDyGnqFqZb4aGiJ+TWGXQJ8N0=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=KCsY9cNkhy1TfAJSUoNVzx4u0nGLWGeF/ggpkGf8tn6EC9pLVLjbauzh0Gmh9Pi9fP9sLVx0Abasn4Uc5HrjuSK5rixb6Z6H6vtnnut+BCSqoABCzXr9y16FWOOqXsSrADHrZZzPyVtdUxiHzqIOjDfrj5s7GP+9yGmgUW6zUZI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=HEgdJMfD; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="HEgdJMfD" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=ZCcDH99LMfELnB0BvCDYj0sMVwL9rjCspO5GmoWat6s=; b=HEgdJMfD38iKEbtemtdJWmPkiw /yj+TtO/O50xxZtlCvYsRmMcqhrOjn99uZV4SL2vxlCfyH8Sov3Ph7Zvv4W1kz+xPLVLIjV8LExwK 4D192TObmaetu9cFrT36KRS1YkF0Rh41Z1B2woxXP+p5Hc4F6lnEAPZASHLCUGAlL2XKepkF8vRAV fVTyBIHmN8SekvtErfOwlvROtbWbjFhSWsUVGJ18zkDxL04+o7Mcl6QX1JRWZLFPptD4oyadHEdJQ +vldr45qgopglUf8lw9Y1SqnQGbAgLunf3G8WBODBnzsz1OJNgsmbQxkwRwfUA++fcuqDgci2qF6r gwJbF1Bg==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD71-0000000Bogv-0LVD; Tue, 21 Jul 2026 10:14:31 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBe-1vCF; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:33 -0600 Message-ID: <20260721155739.62120-7-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 06/11] dmaengine: switchtec-dma: unlink channels before freeing on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" When switchtec_dma_create() fails after channels have been added to dma_dev->channels (either from switchtec_dma_chans_enumerate()'s own error path, or from dma_async_device_register() failing), the channels are released and freed but never removed from dma_dev->channels. The channel status IRQ is already live at this point, and its handler walks dma_dev->channels, so it can dereference a freed channel. Add switchtec_dma_chans_unlist() and call it before releasing and freeing channels in both error paths. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index c752a1b05871..2a1ae27bd1a6 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1184,6 +1184,14 @@ static void switchtec_dma_chans_free(struct switchte= c_dma_dev *swdma_dev) kfree(swdma_dev->swdma_chans); } =20 +static void switchtec_dma_chans_unlist(struct switchtec_dma_dev *swdma_dev) +{ + int i; + + for (i =3D 0; i < swdma_dev->chan_cnt; i++) + list_del(&swdma_dev->swdma_chans[i]->dma_chan.device_node); +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1217,6 +1225,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: + switchtec_dma_chans_unlist(swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 @@ -1318,6 +1327,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) return 0; =20 err_chans_release_exit: + switchtec_dma_chans_unlist(swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31CCA3E49D7; Tue, 21 Jul 2026 16:14:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650475; cv=none; b=VNDCvVb2vsS8yvFisJEAKK415PpXR2c7Zzt2/ni6xAa7gs5zlpBZBvaHgCx9+2nIP2g34Q4MpPMjNEbvGbgUM80qEz3gNCNTqFyTg2kIySxWLo6ZWfgC3kNrVGXUmJqljDZTLB5rcgm1N9CbT8uul5Qll0VLwF8UbUXwohlclB8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650475; c=relaxed/simple; bh=e5EEHnYRyFtAnQNwTPYhwpgPrCIVj3LD7+U+2kElXZU=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=OQtljhy8K9Tq0Whb8xOtDcIruD3hVmP2i+YNSiR6c1vxIFa/qdNRR5WqMprBpMMY7q/V2hoR0gR/gJFDPDkz/2+rsUj0LOmd/AcSeiAXhpuoq27jBOFd1HnEIDE/a9PixB5qBT+WtyR6bUdiTPikfL5ebssBGNHvlMBY/Hb/Mew= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=pdStqkA2; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="pdStqkA2" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=N8CbEj0BXL/N0+Zw+O9CIuTvl0an+jHIknuACSUoKOE=; b=pdStqkA2zsfijWBS9zsOeQZ1VU 50tYQk07J9rREjgs9eI8mEOhJHIUnMnX1JDOSKH3APwQbWpMpgG3PTwlt8EMA8Wme3Cw63zj1I8Ya 1JFee3xKYpr4WuQeIixYoq8ycx2KuF7Dyt1fJeNO+aIHYFyTWpzMeRRAlsNCAI4lCz/QzBywxbvaH bX/7uk87X0A4zjclV9YKHxZbc6yzpOMk1J43En4YnU+JmI8f5jIbNIwL0wCfm7XZFj3pGvDkKZKD0 ES9Yzz4bdx1HH+BUbdGHWqLHktPPHng3bLY8dlyeLEHaXBBLWnOfhYX8dB16cjr6KuRXaajdrxoW/ pKS7mzOQ==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD71-0000000Bogv-3RgC; Tue, 21 Jul 2026 10:14:32 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBj-2g6G; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:34 -0600 Message-ID: <20260721155739.62120-8-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 07/11] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" dma_async_device_unregister() can drop the last reference on dma_dev and free swdma_dev synchronously via switchtec_dma_release(), but switchtec_dma_remove() then uses swdma_dev->bar for iounmap(). Cache bar in a local variable before the unregister call. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 2a1ae27bd1a6..a7e25cb7c0b9 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1376,6 +1376,7 @@ static int switchtec_dma_probe(struct pci_dev *pdev, static void switchtec_dma_remove(struct pci_dev *pdev) { struct switchtec_dma_dev *swdma_dev =3D pci_get_drvdata(pdev); + void __iomem *bar =3D swdma_dev->bar; =20 switchtec_dma_chans_release(pdev, swdma_dev); =20 @@ -1388,7 +1389,7 @@ static void switchtec_dma_remove(struct pci_dev *pdev) =20 dma_async_device_unregister(&swdma_dev->dma_dev); =20 - iounmap(swdma_dev->bar); + iounmap(bar); pci_release_mem_regions(pdev); pci_disable_device(pdev); } --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C96343E49EC; Tue, 21 Jul 2026 16:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650472; cv=none; b=epUmAvqdJnEujAG+0ZpV1nNMsD8VAypWoxjfdlsGcTTkiQMkvcTQ448TwB/RxyHt2iP9eX+krgBsXSNcq0pJHGxVijZJvkrro/+Jj9LBv6RQgzp19iFqshYL2xOP5tcfkXEzk1BAcdAYuP4PivH7bTOK6TxTcKSzFtyp5zpJTeU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650472; c=relaxed/simple; bh=mVTex+MLR4G6CcZm2GMASCBSoPoJBlgVW+4baHEp+CY=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=AQMeC/Yf9+Al5uN7gPtkF7C0YgT8wYWgWKUUxF9sIr1AIvuRq7SyULDUW4dKo8O04px4SflLUdN19Z2F+vh3QBemA6VG5e9PctSKiRMzdtt2OI8le12D0UwD6uVR2Repj5MklcSzjaU0uad8WiQJV8QeN/uT00M3xDO4hD+qtYs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=KFqj1wvw; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="KFqj1wvw" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=vbkRji58jkhW7DibMQPyaCgED48Jit+K9dAZLvkZ8O0=; b=KFqj1wvwNpFHdn67/FE7KOkoK7 +KNKtauciaQHyTxblQg58QrAduz+aNiDxXycGD8W1it7/TodhA4ba812S4LXLEvHNlFVRWPD09xKB zAlua3O8eEpOmwNo8U8W1xFomT889PoWuTxFS6BXIUg1AauBJ5sOgWU9b5SXx+Vu3eYzt7oOicqei eYu+Ij6JnWBI0ywqs+xGO7nMk/5gcu8g2xl0AqDohlJeEqC43qiQUAbukrjUDSMApJuoNr7ia0gUb p/SnccIWl3QEeR2KKnguea47r+hkJOZz2Lf2PxUz2o2R7GCHyR6UJ6md1IcCFtjkCur/v/4ExVONt F8w+ouYA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD6z-0000000Bogv-2MIT; Tue, 21 Jul 2026 10:14:30 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBo-3SWe; Tue, 21 Jul 2026 10:09:50 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:35 -0600 Message-ID: <20260721155739.62120-9-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 08/11] dmaengine: switchtec-dma: fix chan_status_irq cleanup on create() error X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" chan_status_irq stores an MSI-X vector index, but err_exit freed it with plain free_irq() instead of pci_free_irq(), which would free the wrong Linux IRQ. The guard also treated a valid vector index of 0 as unset, skipping the free entirely in that case and leaving the handler registered against soon-to-be-freed swdma_dev. Initialize chan_status_irq to -1 and use the value being non-negative to signal when to free it with pci_free_irq(). Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index a7e25cb7c0b9..4a80aad2d339 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1257,6 +1257,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) if (!swdma_dev) return -ENOMEM; =20 + swdma_dev->chan_status_irq =3D -1; + swdma_dev->bar =3D ioremap(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0)); =20 @@ -1332,8 +1334,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) switchtec_dma_chans_free(swdma_dev); =20 err_exit: - if (swdma_dev->chan_status_irq) - free_irq(swdma_dev->chan_status_irq, swdma_dev); + if (swdma_dev->chan_status_irq >=3D 0) + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); =20 iounmap(swdma_dev->bar); kfree(swdma_dev); --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D7A1C3E49F0; Tue, 21 Jul 2026 16:14:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650475; cv=none; b=Fu+73ovqcj2a8Mz/GNwAPGyULNtV7YuVir2LL3A7SvDv1l2uGd4De8Wy8vl3HjmUEZ/zXrc8cD62nvXVs5vIhOBrNXLxiinh6x2T3hf78+bbgnCvfiSZRc90qR567UMgo/S+SU0Q5kebJ8k7o3Vf6pwCCB2udvYjmigMmXgCKjQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650475; c=relaxed/simple; bh=LUopb06d539UpGMEh8g4hhlz9Yd7La1io2dVKaojs24=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=el3JD98XgQVKQR8eLKIwxXNOFCRHq5eL01Xyrg//esVUXVRunFUnWVk80P4VVPjBBntK3r86OzfWwNAS6oEh+CRiRPV1g5t0rClsC9jVmlIlYDcbdusOgswsUHklNlpABDN6dyHtl7xPDY9MzmS2ODmqzyIipi2DkQoMxQZC5jk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=NxNLltss; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="NxNLltss" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=B/LA72po4uGhtjZRLXQbTh1TUzASR50GDSDWOW2/7tI=; b=NxNLltsshcxcVHYB+8y+UUSeq8 GWE6gI11+pCxXu6PuS+klCNZAK4UnY1gPcZtzZBvyy9LvBXeU8QVR/d8/KAkFCBhVf+h8YKvt6zNJ pxmOnfZPDLrHPpyCm5/wZRyc1yd5RP176jWOFtydhVgsJcjMBlU3riPYLyjgaq5Dki6TaOR0516S+ Io0ah03cIlQru14JOK+CC6UgsYsdDMnazrER9SqkVLxlvxA8y0fX6oGSXJwwme6r5/FHeYoToLQJU ltByfmGYYPauMehwlaQ/S33uQNjpuG4N8xAPxfdv/uRGtdx/xnLKO/FJFuC286rqHT+gRth0OkSQY iHGFDsdA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD72-0000000Bogv-2CeK; Tue, 21 Jul 2026 10:14:33 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2U-00000000GBt-4BFO; Tue, 21 Jul 2026 10:09:51 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Tue, 21 Jul 2026 09:57:36 -0600 Message-ID: <20260721155739.62120-10-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 09/11] dmaengine: ioat: disable relaxed ordering before registering the device X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" ioat3_dma_probe() disabled PCIe relaxed ordering after calling dma_async_device_register(), so if an error occurs and the code jumps to err_disable_interrupts, the function returns with the device still registered in the core's dma_device_list while the caller frees the ioatdma_device struct, leaving a dangling registration that anything walking the device list can dereference after it's been freed. Move the capability read/write ahead of dma_async_device_register() instead. Nothing after registration depends on relaxed ordering already being disabled, and nothing before it depends on the device being registered, so this is a plain reordering. It also means every remaining step after registration can't fail, so there's no need to ever have to unregister the device once registered. Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioat= dma") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165906.249F41F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe Acked-by: Dave Jiang --- drivers/dma/ioat/init.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 737496391109..a57024c4b066 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat/init.c @@ -1170,15 +1170,6 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } =20 - err =3D dma_async_device_register(&ioat_dma->dma_dev); - if (err) - goto err_disable_interrupts; - - ioat_kobject_add(ioat_dma, &ioat_ktype); - - if (dca) - ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); - /* disable relaxed ordering */ err =3D pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); if (err) { @@ -1194,6 +1185,15 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) goto err_disable_interrupts; } =20 + err =3D dma_async_device_register(&ioat_dma->dma_dev); + if (err) + goto err_disable_interrupts; + + ioat_kobject_add(ioat_dma, &ioat_ktype); + + if (dca) + ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); + if (ioat_dma->cap & IOAT_CAP_DPS) writeb(ioat_pending_level + 1, ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET); --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 849A246D56B; Tue, 21 Jul 2026 16:14:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650476; cv=none; b=aVjXx2MALv34w9Cqz1hYky+UggsWaXI0LdKwhOPZ4QMjBruUoeQ0O0LCoPJRzf1ycZk2+o6dVroU0Jnxr8sTdYYx0FvTw7fMut+hE+8nJtEC+JS9q0tF/mJruJ1PSv1p9zmh47FtwefHKCiyKMfIOx5uz7G/TQqFKJRqko3aIeI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650476; c=relaxed/simple; bh=CoUiwWrHYlbdSivViJap2VPMr1u4C1g594WmORgtiq4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=ojaVlx4Ybl1vRoxRfZTcPWj7k+SF0SMewVhnd4Q3lE6LFYo9meHaA6ws948urGq5dQ4/HX/dGj1fvpL3IBpFGi284Yn0AHE9jQJrFQenziyWn30NqWrRHO97/8pCnvTC4YiCA9QSeCRsMW1XMejCpxJ0qTL4jHB6VhD0kAJKhFw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=bVoPrcEW; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="bVoPrcEW" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=ipTAymtpVpnfbcTyjH7O8f3+s0e/pKqBLscUDcJLr7E=; b=bVoPrcEW5F0q5DqF06dLml1hWy G+caamUR8ZXmJuvrGBXUoQjJQAdp+HWBv5CtqpCOkGe0MF5PpnF4n6sh6sHeU28hYv5uskGqQ3dCo Kpy/viV7Z4VQksYuorFgezVGkUFIH8Pc+o2cR+L8Mk/+9MCiJ//XtIuEsM6Ec5LYHRI9s0CmEgWxk s/s5O8doyN9vFMmmyGhwTFvu3Acn+LS/MLHbvgei6CKvpvuXfAXbXvre/7rcVLnoAM3UMQ60qTNIr Udu1+Z3L0LW6o5SPKG3Ci8v/qELgdd7vXg/Np80hOnC4bsyrxYI4vVzl+yhAhro3H8jQn6aB863R3 cMbxmw3g==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD73-0000000Bogv-15X8; Tue, 21 Jul 2026 10:14:33 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2V-00000000GBy-0vlR; Tue, 21 Jul 2026 10:09:51 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe Date: Tue, 21 Jul 2026 09:57:37 -0600 Message-ID: <20260721155739.62120-11-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 10/11] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" Convert the sprintf() calls in the per-channel sysfs attribute show() functions to sysfs_emit(). Signed-off-by: Logan Gunthorpe Acked-by: Dave Jiang --- drivers/dma/ioat/sysfs.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c index e796ddb5383f..976134df8108 100644 --- a/drivers/dma/ioat/sysfs.c +++ b/drivers/dma/ioat/sysfs.c @@ -24,12 +24,12 @@ static ssize_t cap_show(struct dma_chan *c, char *page) { struct dma_device *dma =3D c->device; =20 - return sprintf(page, "copy%s%s%s%s%s\n", - dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", - dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", - dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", - dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", - dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); + return sysfs_emit(page, "copy%s%s%s%s%s\n", + dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", + dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", + dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", + dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", + dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); =20 } static const struct ioat_sysfs_entry ioat_cap_attr =3D __ATTR_RO(cap); @@ -39,8 +39,8 @@ static ssize_t version_show(struct dma_chan *c, char *pag= e) struct dma_device *dma =3D c->device; struct ioatdma_device *ioat_dma =3D to_ioatdma_device(dma); =20 - return sprintf(page, "%d.%d\n", - ioat_dma->version >> 4, ioat_dma->version & 0xf); + return sysfs_emit(page, "%d.%d\n", + ioat_dma->version >> 4, ioat_dma->version & 0xf); } static const struct ioat_sysfs_entry ioat_version_attr =3D __ATTR_RO(versi= on); =20 @@ -118,7 +118,7 @@ static ssize_t ring_size_show(struct dma_chan *c, char = *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); + return sysfs_emit(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); } static const struct ioat_sysfs_entry ring_size_attr =3D __ATTR_RO(ring_siz= e); =20 @@ -127,7 +127,7 @@ static ssize_t ring_active_show(struct dma_chan *c, cha= r *page) struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 /* ...taken outside the lock, no need to be precise */ - return sprintf(page, "%d\n", ioat_ring_active(ioat_chan)); + return sysfs_emit(page, "%d\n", ioat_ring_active(ioat_chan)); } static const struct ioat_sysfs_entry ring_active_attr =3D __ATTR_RO(ring_a= ctive); =20 @@ -135,7 +135,7 @@ static ssize_t intr_coalesce_show(struct dma_chan *c, c= har *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", ioat_chan->intr_coalesce); + return sysfs_emit(page, "%d\n", ioat_chan->intr_coalesce); } =20 static ssize_t intr_coalesce_store(struct dma_chan *c, const char *page, --=20 2.47.3 From nobody Sat Jul 25 00:11:12 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74EB9367291; Tue, 21 Jul 2026 16:14:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650477; cv=none; b=sLJVO4WVYvUuQfnAGgM0N6+rfj2TIy1ZWJ1dLKxoae9evW4a6QBbxvF8EsPWyLUtP3rhen2SLAgLjyP6fmB9vuZ55rZaYjhE4JsACo60FfL0IW4eeU5MVRpPQKL50Qw8T+0pejNkeSMTBtAUvHjXHaiePN+WUkpTkPEgeItU7uk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784650477; c=relaxed/simple; bh=wZh5b9j3IN1dfBMeY4gWUWFxKNS4ygY0JRmIlnf8Bks=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=SiEJBY6Va++d8UiLsaCM7s5IAShfbwYNe67LT5D4xQHwITO8oiqIyl2QeVl90PZrAyN7UXUjn4edg3glJUpLoHu0wBvyOxFV0fk3A7LSGFGi4s1dvFRc8Z2Ar6FE4+G+nKD+LP3a2txmXT7TBnXfUimoD8qacNVOkjZskf2mw/k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=TW7tG9Qc; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="TW7tG9Qc" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=5XTMOt9qO2Z6D+4H00P13TLfSI2zmt4qEt9F81f4Mw0=; b=TW7tG9Qc+bb4TysMJT+Ad/IrYJ wzx8kweYuHsiIPeQ4aQOKtR7ykhqD/IEbhhraPeSC2966DOO1tccRwvsMiEnCWx61hyTjHdyYR4ZJ U48c7djwC9k3aOsFUGVnlqU+5hl09a1Qj7aUOtGTVrrFN3BsyRK2w3bf9TCChm3h4BgyIATK81C6+ zqMQqjDhvkss6/vxInqcHMcSvvsFqk/1m7wWg8GPJFhLA+hPu0LbcUaiWjyPd5b0O94S7X34i4jHS CABxuIG1zJpxxrlQF2HxDHZ82Hh6DOAVjiUfTb2gnLo9TTpwl1tG2o7qY7PDhshf3aqgpMkr2NwoV yzb/rcHA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wmD74-0000000Bogv-0Xmx; Tue, 21 Jul 2026 10:14:34 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1wmD2V-00000000GC3-1jmi; Tue, 21 Jul 2026 10:09:51 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sangyun Kim , Kyungwook Boo Date: Tue, 21 Jul 2026 09:57:38 -0600 Message-ID: <20260721155739.62120-12-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260721155739.62120-1-logang@deltatee.com> References: <20260721155739.62120-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, logang@deltatee.com, jjy600901@snu.ac.kr, sangyun.kim@snu.ac.kr, bookyungwook@gmail.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v2 11/11] dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" plx_dma_create() registered the interrupt handler with request_irq() before initializing plxdev->bar. If the device raised an interrupt in that window, plx_dma_isr() would dereference the still-NULL bar. Move the bar assignment ahead of request_irq() so everything the handler can touch is initialized before it can run. Reported-by: Sangyun Kim Reported-by: Kyungwook Boo Link: https://lore.kernel.org/all/20260610112121.676561-1-jjy600901@snu.ac.= kr Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization= and cleanup") Signed-off-by: Logan Gunthorpe --- drivers/dma/plx_dma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c index 84941a918b01..409898e92c32 100644 --- a/drivers/dma/plx_dma.c +++ b/drivers/dma/plx_dma.c @@ -504,17 +504,17 @@ static int plx_dma_create(struct pci_dev *pdev) if (!plxdev) return -ENOMEM; =20 - rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, - KBUILD_MODNAME, plxdev); - if (rc) - goto free_plx; - spin_lock_init(&plxdev->ring_lock); tasklet_setup(&plxdev->desc_task, plx_dma_desc_task); =20 RCU_INIT_POINTER(plxdev->pdev, pdev); plxdev->bar =3D pcim_iomap_table(pdev)[0]; =20 + rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, + KBUILD_MODNAME, plxdev); + if (rc) + goto free_plx; + dma =3D &plxdev->dma_dev; INIT_LIST_HEAD(&dma->channels); dma_cap_set(DMA_MEMCPY, dma->cap_mask); --=20 2.47.3