From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A38A519DF62; Mon, 31 Aug 2026 19:14:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203667; cv=none; b=RgtwiCiD3BYspaOt0rXX7vUVC8mg0BNVTjC4Ab+SGrevE2BOEZCZmrwJqHVGqctbiKFTKpG7NzXzA0aLc+bodVT0gubB/pnbFlRiGRqUx6ly7RjPdVJUyF765zAkLtomQEQy6uSFRmm52PR5Ee7PQL5liiLe3EOeWho8ylY8+kQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203667; c=relaxed/simple; bh=1cnD3Gj9zQFOIEKM2qgZFXR6J+O8U4cLcWUGVHYpZWI=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=Vc8efcjuyEdajhmNEKhjuzFZAs5Dp5cZ0bZklAlTRiy0VWmYp3yROz4tn0tLvZvb3/Ujf0G8rth+h2uuXZaRgVAuIAwy46Yi0lqgC3nftwtaGsM+zxBda1+iZaKWFUM4D+sbfMXxtnUWVdv5XHsL7Q9XFqURnaDFEGHLRlKoD80= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=nmbWhNXP; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="nmbWhNXP" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=u+dnOUTPkEbHwF/PTSTNOwmhmIEn6z0Rhraajb/lRBk=; b=nmbWhNXP1k723dz/MBBLQadglo epeF/636MBCcU2PVGVWrwv7DbO2LIzH053DwvWvhwAyIkjzbbueOoZKp7bAunkz/RYjWkxuXKHjj2 WlkbDu5JwfegUA2VTTiJ1nuMIgVYTOd4MowfNFvecwv5v0nbMFLLx7SaWZsagjHZ2ue2G7Lw/UGR3 oxC4ntZ5ZnIBc6oxqtymev3PArKT1joenU8Zw8NCPkULUOkCmgXLhyDfjHdt3uPer67qTq+bb7Y+p LxC/0G+t25zS5qHArcc2geQzXtGv7UcE/4kvzd6tc3XmJr8jTLjWSSFB2LKh+7eR5iFL2Uty4TmsN RlIa5ORg==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SV-000000007Bn-0jkm; Mon, 31 Aug 2026 13:14:19 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SH-00000000s1V-1t72; Mon, 31 Aug 2026 13:14:05 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Mon, 31 Aug 2026 13:13:51 -0600 Message-ID: <20260831191403.207631-2-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 01/12] dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_free_desc() frees swdma_chan->hw_sq, hw_cq, and every desc_ring[] entry without clearing the pointers afterward. If switchtec_dma_alloc_chan_resources() fails partway through and calls it during unwind, then a later retry of alloc_chan_resources() fails in switchtec_dma_alloc_desc() before reallocating one of those pointers, its own failure path calls switchtec_dma_free_desc() again and frees the same, already-freed pointers a second time. NULL out each pointer as it's freed so a subsequent call is a no-op for anything already released. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index c133535d3765..a10818efba4e 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -886,14 +886,18 @@ static void switchtec_dma_free_desc(struct switchtec_= dma_chan *swdma_chan) if (swdma_chan->hw_sq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_sq, swdma_chan->dma_addr_sq); + swdma_chan->hw_sq =3D NULL; =20 size =3D SWITCHTEC_DMA_CQ_SIZE * sizeof(*swdma_chan->hw_cq); if (swdma_chan->hw_cq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_cq, swdma_chan->dma_addr_cq); + swdma_chan->hw_cq =3D NULL; =20 - for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) + for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) { kfree(swdma_chan->desc_ring[i]); + swdma_chan->desc_ring[i] =3D NULL; + } } =20 static int switchtec_dma_alloc_desc(struct switchtec_dma_chan *swdma_chan) --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CC8D4CCDCA; Mon, 31 Aug 2026 19:14:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; cv=none; b=QJCDJ68f/gCwuJJ149vm9BG+vUwnNUN8fAB1W3cPAuiikhsp5mrEWNY+jVs4W5bLrvIXHhkFQ3yTejFs7E6TA+FbguWatHbZu8rmvBD0+NZf11RgfWZF9RcT1LuaWlxAPaUEwsMTAcWYEcI+dm8dSPuAwnbs0vdF7JT5J/DwuIw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; c=relaxed/simple; bh=ycRgV6qO1wDEZmcsG0HnqvCRpxdtAUy7b3nM+piqew4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=MrXXTqKoKt3LrCZEdlQOmB7UR3LAWidcqDebZdmlORPJTGFA5c3bOfS5E1HmjIcGGWz2OiO8c54L8DGjKwhI7BSgMDYgqsFGD4n7tDqADruFana2PMfvG1jhOzjKeKpit9GnpGxG6dTp/6q+0qU9+GNK0BFgzBrmxpUaEUnEXUI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=EBheW9BD; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="EBheW9BD" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=wfVFx652V47CW2/a10uYkNzuZ9R9O+SHTNbUJClacJA=; b=EBheW9BDLPEmvele/qW7y8JoxV SsOFd18ulou0lg/hXII41icI2B/igJZjSp+4FrbM1mt11LZ13JFert1NiWXTcpU/dGa5+S3FR2Gpx d231J2yqvRjbkJwkzgICxYrYKBOiHZoluijFBszvxsynLFXWLsUg85ojstbL8yRwnysuJP/wI7Qif fI/Eo72Lc3Jbq+4trBSC7+MqR8PxJMow5MZj6mPemzohmP7ylnSNHbeaHlOVlbKUH+0TfMOXxtdsd C1W8fuc0Hii5HSq0rhiGLOfSKbfeuLwUWN7tYSc1CFLIOdbbXWpTLNJY8q5lvQMrPJtzdkFwKOVMk aVieMosQ==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SV-000000007C3-3t6G; Mon, 31 Aug 2026 13:14:20 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SH-00000000s1X-2Udn; Mon, 31 Aug 2026 13:14:05 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:13:52 -0600 Message-ID: <20260831191403.207631-3-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 02/12] dmaengine: switchtec-dma: fix resource leak in alloc_chan_resources X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_alloc_chan_resources() returns directly on any later failure, without ever freeing the descriptor rings and coherent DMA memory it just allocated. The dmaengine core does not call device_free_chan_resources() when device_alloc_chan_resources() fails, so the driver has to unwind its own partial state. The device-removed check also runs after ring_active and comp_ring_active have already been set true, so a failure there left the channel marked active despite alloc_chan_resources() reporting failure. Add an error-unwind path that disables the channel and frees the descriptor rings on every failure after allocation. ring_active and comp_ring_active are cleared under the same locks switchtec_dma_free_chan_resources() already uses, since the completion tasklet checks comp_ring_active under complete_lock before touching the completion ring, and a stale IRQ can still be in flight when this unwind path runs. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165555.350951F000E9@smtp.ke= rnel.org Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index a10818efba4e..e55fe9ff7e2c 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -988,15 +988,15 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) =20 rc =3D enable_channel(swdma_chan); if (rc) - return rc; + goto err_free_desc; =20 rc =3D reset_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 rc =3D unhalt_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 swdma_chan->ring_active =3D true; swdma_chan->comp_ring_active =3D true; @@ -1007,7 +1007,8 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) rcu_read_lock(); if (!rcu_dereference(swdma_dev->pdev)) { rcu_read_unlock(); - return -ENODEV; + rc =3D -ENODEV; + goto err_ring_inactive; } =20 perf_cfg =3D readl(&swdma_chan->mmio_chan_fw->perf_cfg); @@ -1029,6 +1030,20 @@ static int switchtec_dma_alloc_chan_resources(struct= dma_chan *chan) FIELD_GET(PERF_MRRS_MASK, perf_cfg)); =20 return SWITCHTEC_DMA_SQ_SIZE; + +err_ring_inactive: + spin_lock_bh(&swdma_chan->submit_lock); + swdma_chan->ring_active =3D false; + spin_unlock_bh(&swdma_chan->submit_lock); + + spin_lock_bh(&swdma_chan->complete_lock); + swdma_chan->comp_ring_active =3D false; + spin_unlock_bh(&swdma_chan->complete_lock); +err_disable_channel: + disable_channel(swdma_chan); +err_free_desc: + switchtec_dma_free_desc(swdma_chan); + return rc; } =20 static void switchtec_dma_free_chan_resources(struct dma_chan *chan) --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AC3C3655FD; Mon, 31 Aug 2026 19:14:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203670; cv=none; b=DT3cjGitPmj560bO0S/Uuh691ql9PKmeI9G1roRqw+r0W0gInsorM1aGrDIhv7rBatOM/rY8dQORLmPwZKL/ulXBERzCYSXG83N1EOGVoRYq/hndro1BnhrS+wUJcJAkJej/77voe36biORh/N3cLbjpdFIkMNzgFCZHXq+pn0Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203670; c=relaxed/simple; bh=TVC80r7YZfuNKG7WNYeRUW8DR6Vzdau7PfDym7VgUVo=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=T4+dAtEa4yBZ6L6jheNOUiikW7iAaVKAKAipmGRYx3dPyvSxlhaF1kiU+t1hKzd/Q7Xd7JT/BIH5EW70rWHAuWAi+HW8K7rATHgHGfjKRpYW8mH1g2R1OwjjYe+0Eam4cneOk5tT5wzMDoGZCll+WuwRDeRbH/qWiT7Jdg4Z7Z0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=FXYKt5hx; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="FXYKt5hx" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=S8kpxcLpqlBxR2OaHPmgSkXjcU30SOLBqSRmfVEB9tA=; b=FXYKt5hxXXt8vwZcLKcDeHzxVk hkXaWUAP+3Oq69CBtHX0Jd1sbVsUBJXf9KY9/WnC5Jlly5pKgNMgi8HvYyr3q/yUsXVXMwrhlLkgv 8Bxv5/NyPDq/+8zIga/YKBnL/xd/4iJ1Zj2TL4WTxqu5s73c4GQnQf78CHwk7DSoFnUS+YTeOkew3 I24O6aM5JwYNkEvcBQY3OJxEElLclmvD3hXXoTeDLj4vRHWkxHS3S//qsTryf0zx0Zoh3CdxTj6GU 6eaZAzhpSwp2Ffzz7B7AFmZ7RtV9FsMxzDujFLZ7duP7VOMLtu891nbfFBSlsJ3XUC9hbcvx298G3 ygzXmRxA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SW-000000007CG-32nN; Mon, 31 Aug 2026 13:14:21 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SH-00000000s1Z-35eZ; Mon, 31 Aug 2026 13:14:05 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Mon, 31 Aug 2026 13:13:53 -0600 Message-ID: <20260831191403.207631-4-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 03/12] dmaengine: switchtec-dma: always clear DMA base registers on chan_stop() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chan_stop() returned early if halt_channel() timed out, skipping the writes that clear sq_base/cq_base on the channel, and gave its caller no way to tell the halt hadn't been confirmed. switchtec_dma_free_chan_resources() unconditionally frees the descriptor rings right after calling this function, so if the hardware failed to halt, it could keep writing into memory that had already been freed. Attempt the register clear regardless of whether the halt was successful and have switchtec_dma_chan_stop() return the halt result so callers can tell when it wasn't confirmed. switchtec_dma_free_chan_resources() now skips freeing the descriptor rings (leaking them instead) in case the hardware continues to write into that memory. All this is hardening that is pretty unlikely to be hit in the real world. However, it is correct and the best thing to do against buggy hardware that doesn't tear down correctly and could still write to memory. In this unlikely situation it is better to leak the memory than have hardware randomly trash memory that has already been used for something else. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260721162531.BA01A1F01560@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index e55fe9ff7e2c..e2bb65237d2c 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -543,26 +543,33 @@ switchtec_dma_abort_desc(struct switchtec_dma_chan *s= wdma_chan, int force) spin_unlock_bh(&swdma_chan->complete_lock); } =20 -static void switchtec_dma_chan_stop(struct switchtec_dma_chan *swdma_chan) +static int switchtec_dma_chan_stop(struct switchtec_dma_chan *swdma_chan) { + struct pci_dev *pdev; int rc; =20 rc =3D halt_channel(swdma_chan); - if (rc) - return; =20 rcu_read_lock(); - if (!rcu_dereference(swdma_chan->swdma_dev->pdev)) { + pdev =3D rcu_dereference(swdma_chan->swdma_dev->pdev); + if (!pdev) { rcu_read_unlock(); - return; + return rc; } =20 + if (rc) + pci_err(pdev, + "Channel %d halt timed out, clearing DMA base registers anyway\n", + swdma_chan->index); + writel(0, &swdma_chan->mmio_chan_fw->sq_base_lo); writel(0, &swdma_chan->mmio_chan_fw->sq_base_hi); writel(0, &swdma_chan->mmio_chan_fw->cq_base_lo); writel(0, &swdma_chan->mmio_chan_fw->cq_base_hi); =20 rcu_read_unlock(); + + return rc; } =20 static int switchtec_dma_terminate_all(struct dma_chan *chan) @@ -1050,6 +1057,7 @@ static void switchtec_dma_free_chan_resources(struct = dma_chan *chan) { struct switchtec_dma_chan *swdma_chan =3D container_of(chan, struct switchtec_dma_chan, dma_chan); + int rc; =20 spin_lock_bh(&swdma_chan->submit_lock); swdma_chan->ring_active =3D false; @@ -1059,9 +1067,10 @@ static void switchtec_dma_free_chan_resources(struct= dma_chan *chan) swdma_chan->comp_ring_active =3D false; spin_unlock_bh(&swdma_chan->complete_lock); =20 - switchtec_dma_chan_stop(swdma_chan); + rc =3D switchtec_dma_chan_stop(swdma_chan); switchtec_dma_abort_desc(swdma_chan, 0); - switchtec_dma_free_desc(swdma_chan); + if (!rc) + switchtec_dma_free_desc(swdma_chan); =20 disable_channel(swdma_chan); } --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 397BB38AC97; Mon, 31 Aug 2026 19:14:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; cv=none; b=bnm3jmTZ/5qIIQ85UPb8rS5eUhFriVQ4NzhFZg1DqT4gBCx3ditq2o7Gg57fb3BJ2VArz7rZEVxbDdlrgbBT2Tv8JphcEqnUywCTFzut0AoK4qX+dGwdjwEOpNHfeWuk6sve+J8fWa6DYyWP94ID0quoaK8woNC0kpdVwj3Ijrs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; c=relaxed/simple; bh=Yt16DRCIW4S29RsFvOF6gZmQNYzovey0eIt9ACqbLGY=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=jwdlps3FEInJrT8GHbnDTDTHVRG9QuVV8ZRVVXM/w7Beemo5L9XZ+Jxpl4wfcQfFSSpwJTjpV4rU5/+k9QB678X92crywFp6T+ZZlCUMMkQd7mhI4QFJwd9HmLutYA8Xx5f+Z2GgD8k8tBEzT7WuFKdYtb5Qpw8sXJHmKZjeU58= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=e3+MeVna; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="e3+MeVna" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=BOX/jaXh913y/cVufoW4N9AtktT2hTl23FLqu47NVNU=; b=e3+MeVnaeXHZNzaSaOHV7WmrZt nBGoNfJTKGWanFqnW6pR/jIwPGjrwuFLMvdiobvCtPh30FqCdFFyR/Lqd9dOoQ+BGNJ841O8Vr1DD s90HZL6MGjGvego52ILhWwYB2tfJp5mZ1sBNSPo3fU1UKsgZtt4xGAzGHTgjnIODKQxfM6Wu6Kx4P upd3gkqWQb/5ZDxzAVHz0X6QPgLiu9o6MdxKAC/I988EMAXsBv4q1Z9Oi67KphPmvbxUw9LNBjPE5 nhLEK+yXorxI9/EPQLNXv9lBggvpymiVkicyoRs1RL72sF1QawSlVYgF541uqBsfkDKjjQkVc5Rzf yuyQQBDA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SX-000000007CR-3xh8; Mon, 31 Aug 2026 13:14:22 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SH-00000000s1b-3gSn; Mon, 31 Aug 2026 13:14:05 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko Date: Mon, 31 Aug 2026 13:13:54 -0600 Message-ID: <20260831191403.207631-5-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Frank.li@nxp.com, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 04/12] dmaengine: switchtec-dma: halt channel on alloc_chan_resources error X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" The error-unwind path called disable_channel() before freeing the descriptor rings, but that only clears the enable bit with an unflushed write -- it doesn't halt the channel or clear its DMA base address registers. If unhalt_channel() timed out, the channel's actual state is unknown at that point, so nothing guarantees the hardware isn't still touching the rings when they're freed. Call switchtec_dma_chan_stop() first, matching what switchtec_dma_free_chan_resources() already does before freeing descriptors on the normal teardown path: it synchronously halts the channel and zeroes the DMA base registers. If the halt itself can't be confirmed, skip freeing the descriptor rings (leaking them instead). All this is hardening that is pretty unlikely to be hit in the real world. However, it is correct and the best thing to do against buggy hardware that doesn't tear down correctly and could still write to memory. In this unlikely situation it is better to leak the memory than have hardware randomly trash memory that has already been used for something else. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223647.F0A051F000E9@smtp.ke= rnel.org Link: https://lore.kernel.org/dmaengine/20260727185101.D221C1F000E9@smtp.ke= rnel.org Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index e2bb65237d2c..2d5ba194c99a 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1047,6 +1047,10 @@ static int switchtec_dma_alloc_chan_resources(struct= dma_chan *chan) swdma_chan->comp_ring_active =3D false; spin_unlock_bh(&swdma_chan->complete_lock); err_disable_channel: + if (switchtec_dma_chan_stop(swdma_chan)) { + disable_channel(swdma_chan); + return rc; + } disable_channel(swdma_chan); err_free_desc: switchtec_dma_free_desc(swdma_chan); --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AA9038AC99; Mon, 31 Aug 2026 19:14:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; cv=none; b=Y7mxLOP6Z5AUhlCZVmCIByWabw1v/Zngh9zB33a7ac6NXz9NFM+15WWcOsZiqMDQ9irTcXAOWcGrAKU07B/+qzhb3SEv/o8T5DV1ICrTsRulcbbgAeeOt3KfW8h7ysRlGYR+SqS7L24MMavmKJ8SJ629q8+7j60zSlCex9j8FqM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; c=relaxed/simple; bh=l7nTOrAJzMkh5KESS1YUOStwJXfMvVYQAKNHPBGF/j4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=VZ8gQ3tZiD5UEdI4VdpfNhvpYl1uZgUXh5Hf6XqFwGKxPZCzUDEb8npLfZMqjuKg1LV96pl6Uioiy/KZItcqh15MQYY5ISsrNkoXZwJqmqzJ9Y6hDz0t9UdcD1HHr+NcaOuf8z1bT2kBazb9SmY+zjX5tEvO32ETyJqK8h9fpBQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=ceVe+wmJ; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="ceVe+wmJ" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=PTWlkHovMiOgbZNaiMZ6RyatH9T6alteNe7JaAS7x2E=; b=ceVe+wmJG2MbUeO3S89TZOs8jR 4mbBY2cB4GPTlBYZD/YOt+j9DucHpftPzjtP74goStvfxu9ubYhn9BpAW/b2bJVp93BMLp566jx9Q SNswnVPCD3rBEiFy5j8Qapj//hwsnATJQorRTeQZhgh/J7u0q+LQrjyHKZXz86smfaeIMY7PiuARE R+cSHWe4UrT5Erlf/1G3nJohiWE5bT8DmEVxjNmCHD/h0WqLzXGu4xMi3cKsCVi5I+Ahl5LmxQQJd OujZ5IkuGTWkaGwXzNmJ2v13YiEwMpXFrx/0kaCZqRD/HjztkZ9Z1CEVAdY9qq5nbA8Yt4WbeMWNm 0WisggIw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SY-000000007Cm-3i0o; Mon, 31 Aug 2026 13:14:23 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1d-09uI; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:13:55 -0600 Message-ID: <20260831191403.207631-6-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 05/12] dmaengine: switchtec-dma: fix channel leak on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chans_release() is called in three places but the underlying memory is not freed in all of those places. In order to clean this up, introduce a switchtec_dma_chans_free() helper that will free the memory. Ensure each call to switchtec_dma_chans_release() has a corresponding switchtec_dma_chans_free() call. (The release in switchtec_dma_remove() pairs with the free in switchtec_dma_release()). swdma_dev->chan_cnt is now set to the number of channels that succeeded when one fails to initialise, so switchtec_dma_chans_free() can still be used if not all channels succeed in being allocated. switchtec_dma_chans_free() also removes each channel from dma_dev->channels before freeing it, since the channel status ISR walks that list and would otherwise dereference freed memory. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223024.9BB8A1F000E9@smtp.ke= rnel.org Link: https://lore.kernel.org/dmaengine/20260727190604.397DB1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 2d5ba194c99a..f71c64c137e8 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1188,6 +1188,18 @@ static int switchtec_dma_chans_release(struct pci_de= v *pdev, return 0; } =20 +static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) +{ + int i; + + for (i =3D 0; i < swdma_dev->chan_cnt; i++) { + list_del(&swdma_dev->swdma_chans[i]->dma_chan.device_node); + kfree(swdma_dev->swdma_chans[i]); + } + + kfree(swdma_dev->swdma_chans); +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1213,7 +1225,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, if (rc) { dev_err(&pdev->dev, "Channel %d: init channel failed\n", i); - chan_cnt =3D i; + swdma_dev->chan_cnt =3D i; goto err_exit; } } @@ -1221,10 +1233,8 @@ static int switchtec_dma_chans_enumerate(struct swit= chtec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: - for (i =3D 0; i < chan_cnt; i++) - switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 return rc; } @@ -1233,12 +1243,8 @@ static void switchtec_dma_release(struct dma_device = *dma_dev) { struct switchtec_dma_dev *swdma_dev =3D container_of(dma_dev, struct switchtec_dma_dev, dma_dev); - int i; =20 - for (i =3D 0; i < swdma_dev->chan_cnt; i++) - kfree(swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_free(swdma_dev); =20 put_device(dma_dev->dev); kfree(swdma_dev); @@ -1329,6 +1335,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) =20 err_chans_release_exit: switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 err_exit: if (swdma_dev->chan_status_irq) --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E65C38DC5B; Mon, 31 Aug 2026 19:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203672; cv=none; b=dI5hPklBKfMCx5Uew+w53PPjrAn0EDp7Dq0oZKvB5oq8sLpBLyAElp80Z+vIslMIE+Jo9GWFWUhLxrOf3Fd4mvXVzm/JpdVxKj54O5xeDCKfG/LNID8o6Bsbmmoq44arF0UQflfk9E8F45W3a5OJW2OYt+35MYa4ad0WUxSYf+0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203672; c=relaxed/simple; bh=qCIjXzG6t/QDzZhChzNlq+uRjKyoa/pdmJLAcLkoEQs=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=aiJtjtyek/4apvBRvn4r2Kts9DBrZjmHkaXE9Qg3i4vlRO2q94r8X+etpBm3Xwm1EXxfE3Wipl80U3mD+ili5DeZ4y9oaam4qlqbDiTtW2rXvQaCG97hR1//2k5u79VPlS1SmTlaJrudECpzfyTUyv2r50I7ODHKrH6XK1jb4ho= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=QUDJ+uSf; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="QUDJ+uSf" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=dVJl+hvz80sa41TKXboM7zBTDRX4tzSFBxTrH4qw2Jw=; b=QUDJ+uSfw38/XmZMtRLp8CMrUD iJ8N4Fi+sHxFCk/Hh3k3tCCAj5jHdzEa8pjEgkYw8UtvzJ3vej+M7HEdF6dI/m5JfskBG0dOHXaOj F+CraxmmO6vPzcSPjPv2YN+v7KLW6cNnKh6yyhzKe8p4MX5RQjf1K8WEopW/z35g8RhbdmLA5UsBE KgDSnTxmpMzTzdsF8cFLnPryg++C4Y3uJAeStnbVjPeojmzVDCM1Ir+7ErDYBa932fLPhxEm46HnX Y5HTWpji1++6l57envou3urTr8pzrjbnFS4tjRcNDo6EAM3cyU+5FKKMQMC1eaO6t4ppZTxP53MfZ tk7jYeWQ==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17SZ-000000007D1-2rpX; Mon, 31 Aug 2026 13:14:24 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1f-0p4e; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Mon, 31 Aug 2026 13:13:56 -0600 Message-ID: <20260831191403.207631-7-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 06/12] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chans_release() always returned 0, and no caller checked it. Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index f71c64c137e8..c30530ba78ca 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1177,15 +1177,13 @@ static int switchtec_dma_chan_free(struct pci_dev *= pdev, return 0; } =20 -static int switchtec_dma_chans_release(struct pci_dev *pdev, - struct switchtec_dma_dev *swdma_dev) +static void switchtec_dma_chans_release(struct pci_dev *pdev, + struct switchtec_dma_dev *swdma_dev) { int i; =20 for (i =3D 0; i < swdma_dev->chan_cnt; i++) switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - return 0; } =20 static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A391725B093; Mon, 31 Aug 2026 19:14:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203667; cv=none; b=AjdaWS/5m/hrZejOXqlO9OlSH3+7MeaIuTGl65EEtYZqlStyYg8y+MycsyGnopuwGjY4Rr708YlqHAF21e+unf2iTw+sH/5kkrG8uPQDuxsDLZLRQ2iZ1NSZGVf0uQdJ5QlifrWtO1V9fRdWoTG6W6PMS2kQBTgDSGx7yfKyRWo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203667; c=relaxed/simple; bh=fwbTZ3apAl3oLnTJWw6uVx2cNmrHtHK5g+g6qJg1YW4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=tpERaxvixquMb5O65ASyJuIfn+KXG5nL+V8EDAGUBOJ1TLbPLyrtjVnKzEIPxOIfmohpCKDpJZDU0Y8OPAVP+GUILH/jg81Hq3wn3qjhFGzs4bgDWcFY514X+rBAtfULw2/W+mc8/zB1JYqd5d5e5rjyes//rebcUzALfImO+JE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=pqWIXZEG; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="pqWIXZEG" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=n5UMSOAnxi8lEsvumILEQPHwqv8UDuy4NqR+CvapaUk=; b=pqWIXZEGXqBAnvAMr9dXTIAuKN WADihEqtNmECU0oBw2H8Kmmqttptq2jhHAztOzp5cgsJ/I46Au2cRGjCRJpV2cxxTcimKhjQXa29v mESlkRx7EJR3hdw3aD/KrNjsXZ1IYVX0gUb+JaxJgm/V5QfuiYpnHrUUKVqgHmpX/57RD2ZgE5pH4 XHvn+gZRhJMIL4GJZsGPpuIWGQZhGAcjBnyTe7njEiYEapdvrLjB1AqJr31V0QsSf6ZSfofPgikpv 7zxPl4DzMQNd/tZzWimxo7LTUEfRarxGxBC3sAc2fqk/yvuLsHTJMsjNmCLmTh6q9MZ7gWudX+/qY i8isqyhg==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Sa-000000007DK-22G0; Mon, 31 Aug 2026 13:14:25 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1h-1UN9; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:13:57 -0600 Message-ID: <20260831191403.207631-8-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 07/12] dmaengine: switchtec-dma: fix chan_status_irq cleanup on create() error X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" chan_status_irq stores an MSI-X vector index, but err_exit freed it with plain free_irq() instead of pci_free_irq(), which would free the wrong Linux IRQ. The guard also treated a valid vector index of 0 as unset, skipping the free entirely in that case and leaving the handler registered against soon-to-be-freed swdma_dev. Initialize chan_status_irq to -1 and use the value being non-negative to signal when to free it with pci_free_irq(). Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index c30530ba78ca..3068d9de4e6d 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1262,6 +1262,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) if (!swdma_dev) return -ENOMEM; =20 + swdma_dev->chan_status_irq =3D -1; + swdma_dev->bar =3D ioremap(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0)); =20 @@ -1336,8 +1338,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) switchtec_dma_chans_free(swdma_dev); =20 err_exit: - if (swdma_dev->chan_status_irq) - free_irq(swdma_dev->chan_status_irq, swdma_dev); + if (swdma_dev->chan_status_irq >=3D 0) + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); =20 iounmap(swdma_dev->bar); kfree(swdma_dev); --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CD522C026C; Mon, 31 Aug 2026 19:14:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; cv=none; b=iNgVdGJwDEmgVJqac5fwdS1vkLowCnNFZ/hOP+zQ9lw3m6Y8uw5cK9MluarwDEbKOyfIUYoPqPCcB92Uy6PT6z9vO80gi1FAN2ZDFsgEirrtkoFtAsnhG4khgfBe7wJ8BT0hV/BWt0nhdWqYFplfR0fJO0NzSvPCreLNZF3iurI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; c=relaxed/simple; bh=79mYpblsmiFWw8Bbx73RKfKeWgDVSiOSpcI2GZ4zFVc=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=Fw+UwhKBUur0xZNj0C3dEt4ZES6ZAWixrQmhAdf48VFWNUUr3s5uNu8YZIiIphMFccR/9D3ugFRtyva37Kahy+yxR5kqUT26Ip7j/4YxSEedM2m/lTvTnW4QyF0mS5ZXfS1JprmABdL4/dG+MmZKdw1qBRpDZuirP+8hoQE4+ns= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=TG4tak9S; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="TG4tak9S" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=Aaf6JxG1s0jf/AwW6M43JQGZZntdld7FYYVpfPheOg0=; b=TG4tak9SUxWempf10qjNAOP0kc 5p38jXv8sDYj/GMr0CeJOPxsEcQu3rZHxV0kvzySDGNvMTRkMvMttetTRRKRsbLaEVHFnVr42i0u4 B9N4td1DZX4pezlnTdz6/PSBMhjoZYyVBOh7IpP7iRu29wWe4xCXScGtWMSb7HqsO3tIWFty6I6Bc OdQBXKF11Df/d4BVUpRJWvFnXe6d+GNi+4D5z2bM3vBkzbs5Ex6ke7gtE0kaUUCGwyuNrFV8l06a6 eewusZEQLN7RK9oBIIGwmlEy6l3OGRbvdtzIHvq93W+RsL8ecXan020k6yYijxusDg9MBl37znWCb QQrIgPXg==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Sb-000000007DZ-0vVO; Mon, 31 Aug 2026 13:14:25 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1j-2AK7; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:13:58 -0600 Message-ID: <20260831191403.207631-9-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 08/12] dmaengine: switchtec-dma: disable channels before freeing on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" When switchtec_dma_create() fails after channels have been added to dma_dev->channels (either from switchtec_dma_chans_enumerate()'s own error path, or from dma_async_device_register() failing), the channel status IRQ is still live while the channels are released and freed, so it can fire mid-teardown against channels that are only partially torn down. Add switchtec_dma_chans_disable(), which frees the channel status IRQ before releasing and freeing channels in both error paths. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Link: https://lore.kernel.org/dmaengine/20260721162822.05CDD1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 3068d9de4e6d..c2803af6589d 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1198,6 +1198,15 @@ static void switchtec_dma_chans_free(struct switchte= c_dma_dev *swdma_dev) kfree(swdma_dev->swdma_chans); } =20 +static void switchtec_dma_chans_disable(struct pci_dev *pdev, + struct switchtec_dma_dev *swdma_dev) +{ + if (swdma_dev->chan_status_irq >=3D 0) { + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); + swdma_dev->chan_status_irq =3D -1; + } +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1231,6 +1240,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: + switchtec_dma_chans_disable(pdev, swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 @@ -1334,6 +1344,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) return 0; =20 err_chans_release_exit: + switchtec_dma_chans_disable(pdev, swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D9AD339370; Mon, 31 Aug 2026 19:14:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; cv=none; b=KHf2Dl90Dgp0VvNjUlj02m1GqKuUbvIPPZWIbk70UT4cl4le1wsfTKSf7vKinJ+B5vuygmHT+iClurZ2PHxu/pLRftV+47p8ZfIAuj5cmYV6NcoWP1qw5iuOlIqPWhHFAz4fs+EARwK1w7mTPcKbmTAOznK7jD8nsgKxbFcmyjU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203668; c=relaxed/simple; bh=OdYMauSOMVqtmhbAMGKb7SLpt/PeEUye59CzQy4IYj4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=UibaFA7bfw44mF/UbS0S4/T05uGooz48AQZlkIvGd55RkZeRS76nYKVrcb7tQ+oL6YKbcPT3/kuSIFWj5EgNGSEB4bCMja/c5ydDaX9zgCTgDjmEwsYcHZhhSYEHoOEeZs99vigvf8ihrwGMPL3nbsIhZxglaC2eyhZWgdKE+s0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=QKw9iHhe; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="QKw9iHhe" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=w8iS4kDDCughqNC87L2j6uPD9gcxQyLhqwq0a9EutZ0=; b=QKw9iHheWwglj8DhXAxENZ6v0U CmdZkYahIIK+i8QdFh30j5/vDVB8VmdcxS2fH5g4YcfD23BthIRjjA2sySMAl0A8+Z+gA4WCZm3qo UMxR5fuR0yabasTlBJPgabCMNAw8o/WaTTJ+/sthSKM4S9szYkXY4SLXV65KOeRjSL5ADcSQ1D5Kz w7AK9dMEeVvzJJ+cxR7FSidTvuxAhHO+1ArRtROg4AXSxOios21WLK/gd2tDbDdVpfga+rAroPOqc CHBZ7boQLYYi3vOjfd/mPsp0PdBqtdBriJbkrXqpWqLqEWqMaFaKTu9votV5CSbF0oPkT1J+5wyVY KZfbvC1g==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Sc-000000007Dq-01by; Mon, 31 Aug 2026 13:14:26 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1l-2kjU; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:13:59 -0600 Message-ID: <20260831191403.207631-10-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 09/12] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" dma_async_device_unregister() can drop the last reference on dma_dev and free swdma_dev synchronously via switchtec_dma_release(), but switchtec_dma_remove() then uses swdma_dev->bar for iounmap(). Cache bar in a local variable before the unregister call. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index c2803af6589d..3b4ec4ad2bbe 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1393,6 +1393,7 @@ static int switchtec_dma_probe(struct pci_dev *pdev, static void switchtec_dma_remove(struct pci_dev *pdev) { struct switchtec_dma_dev *swdma_dev =3D pci_get_drvdata(pdev); + void __iomem *bar =3D swdma_dev->bar; =20 switchtec_dma_chans_release(pdev, swdma_dev); =20 @@ -1405,7 +1406,7 @@ static void switchtec_dma_remove(struct pci_dev *pdev) =20 dma_async_device_unregister(&swdma_dev->dma_dev); =20 - iounmap(swdma_dev->bar); + iounmap(bar); pci_release_mem_regions(pdev); pci_disable_device(pdev); } --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 320863644CF; Mon, 31 Aug 2026 19:14:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203669; cv=none; b=r7vv3wqNfOn++AeVbbDR2mjX+mHeTHrYxDMkAq1+mX8ZHR2LK8wGJ+CrR+LFyJDif0+b7tJw5xCiagJAvXBJNEVESx+x2pSn/12oQfv6U8G+G8aseTpOP0F+zqbL58lhZhcVp0e9w58el5lziG7q3nQsZzK1kRoVZN4mhWbPvy0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203669; c=relaxed/simple; bh=ZPC6ghhCqsMrK87BUv1t3zX8JsRmF0Kr687Mia/l1FY=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=MbHjR8Z/gTRw0RucdcgDAf4Tig6gLrUINMVstDNlIeguHUkFZtYjZjlSq1LZO7lYB8OHRcm6ZH/wUbHDc09OENe2y6HRarLLjRwSGkm9LT6JiUR7zPNmozYIGcJvdrIcRJZgASUJ8H69zOuhjsW6BXoMwMc+Lo6qZ4TGqjIR/Mk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=sqYWyO2v; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="sqYWyO2v" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=hPftQcQVknl4RJ4A76V5p6ISXP3pirJAXoAlUaAoIDM=; b=sqYWyO2v8Au5skUUvOsky37v1U sDS98Fg6lsli/2leZtunLNw7YSEwiGTD9LMtZ0q+/ElsUoKODJ7bWXcq/tidH0ZOxXPqQheQc6mvJ kHweMAooBvUgIxlk0Ms0ZeAt+BS7PtRCGu2+20B+t+2hwi5R3BuAFJM74EGE2cvAnrry/4nk8vnJk tXFK0pWsjtzxt+3IZ+YjloYptgWNFsn7OxA9W4CSG+XdfrFK1WJwHAxk5uJlW789/+oSfI5OirNwF Xf6ah1o0Bl1FlsU1QKF3tr2zalJXvLbrJef2NzSEnImDO2EeCqrDawdKqgY/e28CuDbDqUhuquV2R i79PNVeA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Sc-000000007E6-3GV5; Mon, 31 Aug 2026 13:14:27 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1n-3Lzd; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Mon, 31 Aug 2026 13:14:00 -0600 Message-ID: <20260831191403.207631-11-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 10/12] dmaengine: ioat: disable relaxed ordering before registering the device X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" ioat3_dma_probe() disabled PCIe relaxed ordering after calling dma_async_device_register(), so if an error occurs and the code jumps to err_disable_interrupts, the function returns with the device still registered in the core's dma_device_list while the caller frees the ioatdma_device struct, leaving a dangling registration that anything walking the device list can dereference after it's been freed. Move the capability read/write ahead of dma_async_device_register() instead. Nothing after registration depends on relaxed ordering already being disabled, and nothing before it depends on the device being registered, so this is a plain reordering. It also means every remaining step after registration can't fail, so there's no need to ever have to unregister the device once registered. Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioat= dma") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165906.249F41F000E9@smtp.ke= rnel.org Acked-by: Dave Jiang Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/ioat/init.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 737496391109..a57024c4b066 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat/init.c @@ -1170,15 +1170,6 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } =20 - err =3D dma_async_device_register(&ioat_dma->dma_dev); - if (err) - goto err_disable_interrupts; - - ioat_kobject_add(ioat_dma, &ioat_ktype); - - if (dca) - ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); - /* disable relaxed ordering */ err =3D pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); if (err) { @@ -1194,6 +1185,15 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) goto err_disable_interrupts; } =20 + err =3D dma_async_device_register(&ioat_dma->dma_dev); + if (err) + goto err_disable_interrupts; + + ioat_kobject_add(ioat_dma, &ioat_ktype); + + if (dca) + ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); + if (ioat_dma->cap & IOAT_CAP_DPS) writeb(ioat_pending_level + 1, ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET); --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B820238BF97; Mon, 31 Aug 2026 19:14:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; cv=none; b=eyEWpSa/L84NqsVosJwvGlxedd2Kmyq59YXZWTree9m5wNYw4DaN1MjJ+2YdkK/rFztJy0QMqvx0ryf5bS18JprxRFs1m8tMFyjmQirx3genNzb2S4L/WReRNNI59nLWqo9Z8hBAkXNJo6VyjuwAj/uRRGhCb6utTuq4o3EYP9c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203671; c=relaxed/simple; bh=cbKMI/Gfwjo7Isog9AOySnQSoZYzJgpCshFJq+hwjF0=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=B4Y+NvldPdvNRafPIqWYnaLNmMvfgZM9dosK6W6SPkIT38RlvMTb6PwCDKGUVV/9R7QSh27w2Hy5mCSmQEdBBfg3NR7om7J8NM3MfTNk/4GdBBrmptZWKZuUL9sFYnhpgHSwZZgC1FHB1FRNMDqYoqA1gG+BJtkrDF0eD6aEesk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=KW8y6Iqb; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="KW8y6Iqb" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=42ekhpUOIdWoqhmhF+8NzZGjM3R4mKuws/+M7N324g4=; b=KW8y6IqbmSapvl5ssQrWXjJ1pP XTIgN+oHmZ4X0A/lOPbl3wxVnWOZvI6LSul1fJ0lu2UEzgn+3VQ0t3vxxTIg9x3v8lxHOERN3kuCP qNAx+IC1G/edcn80QeOVATdsdTI/ws6sLKinEDFIb47KslvXSHYZIeGpKPNzPoON98H0iBgC1MuSt n5ucEbbeDhuV3YBCH6Fuz0MzV7qwJ8MGF5v1iUkYH3zTw2uqJDjOaI1lpUGqB7Gjlfzblz+HCEDNp A7GMtYMQF7gb9h1/SVvHR6qrOO7eo05+Nf80qCXZAqf94LNtudR60Z8W9hz8GnLdmdtHTHJYaAzy0 4M+WKEjQ==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Sd-000000007EP-3XxJ; Mon, 31 Aug 2026 13:14:28 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SI-00000000s1p-3wwb; Mon, 31 Aug 2026 13:14:06 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Mon, 31 Aug 2026 13:14:01 -0600 Message-ID: <20260831191403.207631-12-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 11/12] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" Convert the sprintf() calls in the per-channel sysfs attribute show() functions to sysfs_emit(). Acked-by: Dave Jiang Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/ioat/sysfs.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c index e796ddb5383f..976134df8108 100644 --- a/drivers/dma/ioat/sysfs.c +++ b/drivers/dma/ioat/sysfs.c @@ -24,12 +24,12 @@ static ssize_t cap_show(struct dma_chan *c, char *page) { struct dma_device *dma =3D c->device; =20 - return sprintf(page, "copy%s%s%s%s%s\n", - dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", - dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", - dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", - dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", - dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); + return sysfs_emit(page, "copy%s%s%s%s%s\n", + dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", + dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", + dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", + dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", + dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); =20 } static const struct ioat_sysfs_entry ioat_cap_attr =3D __ATTR_RO(cap); @@ -39,8 +39,8 @@ static ssize_t version_show(struct dma_chan *c, char *pag= e) struct dma_device *dma =3D c->device; struct ioatdma_device *ioat_dma =3D to_ioatdma_device(dma); =20 - return sprintf(page, "%d.%d\n", - ioat_dma->version >> 4, ioat_dma->version & 0xf); + return sysfs_emit(page, "%d.%d\n", + ioat_dma->version >> 4, ioat_dma->version & 0xf); } static const struct ioat_sysfs_entry ioat_version_attr =3D __ATTR_RO(versi= on); =20 @@ -118,7 +118,7 @@ static ssize_t ring_size_show(struct dma_chan *c, char = *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); + return sysfs_emit(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); } static const struct ioat_sysfs_entry ring_size_attr =3D __ATTR_RO(ring_siz= e); =20 @@ -127,7 +127,7 @@ static ssize_t ring_active_show(struct dma_chan *c, cha= r *page) struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 /* ...taken outside the lock, no need to be precise */ - return sprintf(page, "%d\n", ioat_ring_active(ioat_chan)); + return sysfs_emit(page, "%d\n", ioat_ring_active(ioat_chan)); } static const struct ioat_sysfs_entry ring_active_attr =3D __ATTR_RO(ring_a= ctive); =20 @@ -135,7 +135,7 @@ static ssize_t intr_coalesce_show(struct dma_chan *c, c= har *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", ioat_chan->intr_coalesce); + return sysfs_emit(page, "%d\n", ioat_chan->intr_coalesce); } =20 static ssize_t intr_coalesce_store(struct dma_chan *c, const char *page, --=20 2.47.3 From nobody Sat Sep 26 13:47:20 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93D0E38DC5C; Mon, 31 Aug 2026 19:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203672; cv=none; b=QQy+WwSOvcrG9uJ/fqsX77sX5Nl7fblELQ6yS7SoZv78cLvXkftn0y0Pe6f1fNv640r3gBwSXG3LJwroh1ukVxH56GzkPmvWL9VMyQt/MJzWpKi+otd1vso/1nnzyxxsYZKfuCHfheTf9qthDrt+U3FD2lWHK+tieeqDGg+EeZQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788203672; c=relaxed/simple; bh=J5Z+negq9t0hkOPhOevbAhPTgwWt6tQSntxeoP4sOG4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=IwYbQmgss8rz4fEorTjJKLFMhbEc5f/S9S2WALpMOvHn0RdNOYCGzp6ZfRcx56YOILM4X21q+OMku2ZdY4K60mLFBZezZ9vcTcxTV3vJ4KuGqMwDwNSZaSucHrLjB7JvjadIVVKGmQnIP22c8lErAQdFGCCqeqVJsxYSdcx4xm4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=Yxk60JSH; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="Yxk60JSH" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=RnnO1NNcjLe9HNz+vfdGpNqTtaHUrE/25DnSIreOxdA=; b=Yxk60JSHW8Qzbn10IR5B1ZoEA5 pL2EtJqGqkgA//b7DbBZzzsFDMQoP20RZW+t9QTWhh0mu0qdW/LG1ZMCoN5kh7iWc6hqDEkoLjwdv DoCt4PZqEhCFM1Zkl6Y2ENCTh4kCu4FXQjycvkfEyVZu9fRld07brSqfGfEVhxGZNimufB6CanZ3m qKmwO0hK9VsG2Thd+UWhcqKR//1RNzSG6bKMxpMlEsZ/J2hxZNfbCtD53gDHVF6bZW0spbrlJe6QF tFsdyRSfErKlYVez/oqmMttLKswlc6PYFZA+PmDvhrc5dXKhVgkTluu/Ww5ChIVJ9VakAVkGT0Gl0 52R+cO5A==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x17Se-000000007Eg-4246; Mon, 31 Aug 2026 13:14:29 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x17SJ-00000000s1r-0Ltr; Mon, 31 Aug 2026 13:14:07 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sangyun Kim , Kyungwook Boo , Frank Li Date: Mon, 31 Aug 2026 13:14:02 -0600 Message-ID: <20260831191403.207631-13-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260831191403.207631-1-logang@deltatee.com> References: <20260831191403.207631-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, logang@deltatee.com, jjy600901@snu.ac.kr, sangyun.kim@snu.ac.kr, bookyungwook@gmail.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v5 12/12] dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" plx_dma_create() registered the interrupt handler with request_irq() before initializing plxdev->bar. If the device raised an interrupt in that window, plx_dma_isr() would dereference the still-NULL bar. Move the bar assignment ahead of request_irq() so everything the handler can touch is initialized before it can run. Reported-by: Sangyun Kim Reported-by: Kyungwook Boo Link: https://lore.kernel.org/all/20260610112121.676561-1-jjy600901@snu.ac.= kr Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization= and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/plx_dma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c index 84941a918b01..409898e92c32 100644 --- a/drivers/dma/plx_dma.c +++ b/drivers/dma/plx_dma.c @@ -504,17 +504,17 @@ static int plx_dma_create(struct pci_dev *pdev) if (!plxdev) return -ENOMEM; =20 - rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, - KBUILD_MODNAME, plxdev); - if (rc) - goto free_plx; - spin_lock_init(&plxdev->ring_lock); tasklet_setup(&plxdev->desc_task, plx_dma_desc_task); =20 RCU_INIT_POINTER(plxdev->pdev, pdev); plxdev->bar =3D pcim_iomap_table(pdev)[0]; =20 + rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, + KBUILD_MODNAME, plxdev); + if (rc) + goto free_plx; + dma =3D &plxdev->dma_dev; INIT_LIST_HEAD(&dma->channels); dma_cap_set(DMA_MEMCPY, dma->cap_mask); --=20 2.47.3