dma_test_stop_rings() stops the RX and TX rings before calling
tb_xdomain_disable_paths().  tb_ring_stop() zeroes the ring's descriptor
base and the cancellation callbacks unmap and free the frame buffers, so
by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit any
data still in flight has nowhere to drain to; on ASMedia ASM4242-class
host routers the bit never clears and every teardown burns the full
500 ms timeout.  This is the same defect as the one in tbnet_tear_down(),
fixed as CVE-2026-74691 ("net: thunderbolt: Tear down DMA paths before
stopping the rings").

Move the tb_xdomain_disable_paths() call before the tb_ring_stop() calls
in dma_test_stop_rings(), so in-flight data drains while the rings are
still active, and only then stop the rings and free the frame buffers.

Fixes: edc0f494ed966 ("thunderbolt: Add DMA traffic test driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/thunderbolt/dma_test.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/thunderbolt/dma_test.c b/drivers/thunderbolt/dma_test.c
index 7877319b1b03..4acce31f1397 100644
--- a/drivers/thunderbolt/dma_test.c
+++ b/drivers/thunderbolt/dma_test.c
@@ -215,11 +215,6 @@ static void dma_test_stop_rings(struct dma_test *dt)
 {
 	int ret;
 
-	if (dt->rx_ring)
-		tb_ring_stop(dt->rx_ring);
-	if (dt->tx_ring)
-		tb_ring_stop(dt->tx_ring);
-
 	ret = tb_xdomain_disable_paths(dt->xd, dt->tx_hopid,
 				       dt->tx_ring ? dt->tx_ring->hop : -1,
 				       dt->rx_hopid,
@@ -227,6 +222,11 @@ static void dma_test_stop_rings(struct dma_test *dt)
 	if (ret)
 		dev_warn(&dt->svc->dev, "failed to disable DMA paths\n");
 
+	if (dt->rx_ring)
+		tb_ring_stop(dt->rx_ring);
+	if (dt->tx_ring)
+		tb_ring_stop(dt->tx_ring);
+
 	dma_test_free_rings(dt);
 }
 
-- 
2.25.1

Hi,

On Tue, Aug 25, 2026 at 11:47:59AM +0800, Haotian Zhang wrote:
> dma_test_stop_rings() stops the RX and TX rings before calling
> tb_xdomain_disable_paths().  tb_ring_stop() zeroes the ring's descriptor
> base and the cancellation callbacks unmap and free the frame buffers, so
> by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit any
> data still in flight has nowhere to drain to; on ASMedia ASM4242-class
> host routers the bit never clears and every teardown burns the full
> 500 ms timeout.  This is the same defect as the one in tbnet_tear_down(),
> fixed as CVE-2026-74691 ("net: thunderbolt: Tear down DMA paths before
> stopping the rings").
> 
> Move the tb_xdomain_disable_paths() call before the tb_ring_stop() calls
> in dma_test_stop_rings(), so in-flight data drains while the rings are
> still active, and only then stop the rings and free the frame buffers.
> 
> Fixes: edc0f494ed966 ("thunderbolt: Add DMA traffic test driver")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>

I dropped the Fixes that as I don't think it's needed. DMA test is not
anything a regular user should care about anyways.

Applied to thunderbolt.git/next, thanks!