From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B586C372B5E; Wed, 2 Sep 2026 06:22:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; cv=none; b=B/gmmhJZCRCwHP5M/n1ZnbGFYmmgGwSd5zD/zsODwDTYJlgj+q3j4Ts0uGuLh62c9inVEa9kINEyvfr9+gpSM/1rptKkKo4qu0e3KLUtyZtJkouUqzpRppbn+FO0InNrRNcX+M+OH/fHlXTfzoc4kuxbYczgqXO9zXKOd1ZQud0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; c=relaxed/simple; bh=1cnD3Gj9zQFOIEKM2qgZFXR6J+O8U4cLcWUGVHYpZWI=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=YqO6zYEq+DWOfVmYamNDyRAY0qYpn7nD8+VdelvSeoRyVH8nDP+fD1xzkXpEyIbYR5IGEKMjFNsaOFMESL0CxfbpFOtujbiFhdXL0oBpHuFn9LhccpC6TEKSd5zGj9JwGQjCdLY0dkk8MTmvgmJ12KI2Gpo8Dc+U3MRpYt/etwk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=EDyt2EDz; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="EDyt2EDz" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=u+dnOUTPkEbHwF/PTSTNOwmhmIEn6z0Rhraajb/lRBk=; b=EDyt2EDzxTvcldBQEqjuK3Qx80 dD6VpFimY2xfx/YgukJ5RjstlSy0GoigCfILYAiPacsBynqMWbMhJUuGZbtehkxXq6VDKjf3b/xAP bJuiguLuVcG2XUY6hhajwMjxR3ARsuCqSw4UKMQtx2T+WCKjR5JpD1JeFfGa/uwtQXhQgxM2U+sIO YqV5ugLLyoS8radNVkj9zgdUL7EKBF5k8ydVCGVF2edrrWAtOC0DIM0SWwgQ/zXN1AlXSUS4481XT nZEp/H7KM3Ytw7E0wAO+xyRsJZ0buE/YaThY2qMS6X4UEAb6HlmHAsY/a3gVsVLscVfnFVLPvVrK6 yrJEOrzA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMf-00000000LqS-2riy; Wed, 02 Sep 2026 00:22:30 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMA-0000000085L-2SIc; Wed, 02 Sep 2026 00:21:58 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Wed, 2 Sep 2026 00:21:43 -0600 Message-ID: <20260902062153.31048-2-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 01/10] dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_free_desc() frees swdma_chan->hw_sq, hw_cq, and every desc_ring[] entry without clearing the pointers afterward. If switchtec_dma_alloc_chan_resources() fails partway through and calls it during unwind, then a later retry of alloc_chan_resources() fails in switchtec_dma_alloc_desc() before reallocating one of those pointers, its own failure path calls switchtec_dma_free_desc() again and frees the same, already-freed pointers a second time. NULL out each pointer as it's freed so a subsequent call is a no-op for anything already released. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index c133535d3765..a10818efba4e 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -886,14 +886,18 @@ static void switchtec_dma_free_desc(struct switchtec_= dma_chan *swdma_chan) if (swdma_chan->hw_sq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_sq, swdma_chan->dma_addr_sq); + swdma_chan->hw_sq =3D NULL; =20 size =3D SWITCHTEC_DMA_CQ_SIZE * sizeof(*swdma_chan->hw_cq); if (swdma_chan->hw_cq) dma_free_coherent(swdma_dev->dma_dev.dev, size, swdma_chan->hw_cq, swdma_chan->dma_addr_cq); + swdma_chan->hw_cq =3D NULL; =20 - for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) + for (i =3D 0; i < SWITCHTEC_DMA_RING_SIZE; i++) { kfree(swdma_chan->desc_ring[i]); + swdma_chan->desc_ring[i] =3D NULL; + } } =20 static int switchtec_dma_alloc_desc(struct switchtec_dma_chan *swdma_chan) --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5326B382F15; Wed, 2 Sep 2026 06:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; cv=none; b=KlOHMRhtYZl5ami4wvXzpFDba7h1/A0ZbANvf9i1vW7Pj+TBBofxv6vF2K3uoDCM0Mcbc0m5NiaP0ZfDACEU8W6Cc11tcVQu+E+b66p657eEjan3ED1AwjnNwnDGF0GcoEhbHjDZZbp23Seo8XhnFlAyA0t3yEC2UtyaoF4gIlQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; c=relaxed/simple; bh=ycRgV6qO1wDEZmcsG0HnqvCRpxdtAUy7b3nM+piqew4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=s+Y5UzIdT7tvSEEddbwqphYtWkEf+2AvGrXbsDlnMWVW8/8Dmf/0iz2G7iB+GXDp0oUleWh2ScTzWRZq77KfFGokOmD1Hye5LQYyhn6M045W3q24ddlrqzvcyQ7720p7sEn4OC+IauOg885dCHQoiKtX32Ujbu8Fq/V4TPd/xsU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=WDv/q3og; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="WDv/q3og" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=wfVFx652V47CW2/a10uYkNzuZ9R9O+SHTNbUJClacJA=; b=WDv/q3ogQynmjgpEn79GqLH8PC W73nqJwQMHbUGly5FfvqBrasdrC969WPL842Mx/odzgl5MzVk47jImm4U1XG4HVP7d3A0LcpFbbFn jFYng2LTr566xVfKhFbE6y9kGYUEsL+nK6BZBAFy3OytoB/sgzrZ6S5/ff6OPQnWUl/brhAg0lW98 Gf8LYwLIcKud2EoI3tIxEZCMTCiDROHWEh/KFFMn+JHzQt41TlIN+kA9IGRkwMf5gJ+mnZQfcUeRo yBwrDe2bzcmu0U0udMrPoghwRWdkqJQsfuoqJDoeO8vNmHA/b4ARx7/iO/E3QYKGU1xAH3r6HFL4q SRdo0Ftw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMg-00000000Lqi-2Aqy; Wed, 02 Sep 2026 00:22:31 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMA-0000000085N-3ArI; Wed, 02 Sep 2026 00:21:58 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:44 -0600 Message-ID: <20260902062153.31048-3-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 02/10] dmaengine: switchtec-dma: fix resource leak in alloc_chan_resources X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_alloc_chan_resources() returns directly on any later failure, without ever freeing the descriptor rings and coherent DMA memory it just allocated. The dmaengine core does not call device_free_chan_resources() when device_alloc_chan_resources() fails, so the driver has to unwind its own partial state. The device-removed check also runs after ring_active and comp_ring_active have already been set true, so a failure there left the channel marked active despite alloc_chan_resources() reporting failure. Add an error-unwind path that disables the channel and frees the descriptor rings on every failure after allocation. ring_active and comp_ring_active are cleared under the same locks switchtec_dma_free_chan_resources() already uses, since the completion tasklet checks comp_ring_active under complete_lock before touching the completion ring, and a stale IRQ can still be in flight when this unwind path runs. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165555.350951F000E9@smtp.ke= rnel.org Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index a10818efba4e..e55fe9ff7e2c 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -988,15 +988,15 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) =20 rc =3D enable_channel(swdma_chan); if (rc) - return rc; + goto err_free_desc; =20 rc =3D reset_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 rc =3D unhalt_channel(swdma_chan); if (rc) - return rc; + goto err_disable_channel; =20 swdma_chan->ring_active =3D true; swdma_chan->comp_ring_active =3D true; @@ -1007,7 +1007,8 @@ static int switchtec_dma_alloc_chan_resources(struct = dma_chan *chan) rcu_read_lock(); if (!rcu_dereference(swdma_dev->pdev)) { rcu_read_unlock(); - return -ENODEV; + rc =3D -ENODEV; + goto err_ring_inactive; } =20 perf_cfg =3D readl(&swdma_chan->mmio_chan_fw->perf_cfg); @@ -1029,6 +1030,20 @@ static int switchtec_dma_alloc_chan_resources(struct= dma_chan *chan) FIELD_GET(PERF_MRRS_MASK, perf_cfg)); =20 return SWITCHTEC_DMA_SQ_SIZE; + +err_ring_inactive: + spin_lock_bh(&swdma_chan->submit_lock); + swdma_chan->ring_active =3D false; + spin_unlock_bh(&swdma_chan->submit_lock); + + spin_lock_bh(&swdma_chan->complete_lock); + swdma_chan->comp_ring_active =3D false; + spin_unlock_bh(&swdma_chan->complete_lock); +err_disable_channel: + disable_channel(swdma_chan); +err_free_desc: + switchtec_dma_free_desc(swdma_chan); + return rc; } =20 static void switchtec_dma_free_chan_resources(struct dma_chan *chan) --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B99C390226; Wed, 2 Sep 2026 06:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; cv=none; b=LjrqHEuDFbdAS0xDZkeAHCxAnh8rpgB3002WJxnzXGT44zMDwRfYGJ9EKJxuWKm/ekjvptN9Q0OYFPgarZtGGLhN/eWqEkMZcAwMzXU0jrqZ07VzzhMHgqLF/vP4Yoqay5Qw7d8VMc8rxYzfcXVG/Q+pa2w384EuwB/4BjuXZTA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; c=relaxed/simple; bh=D5Wg12naI0c815Q0uPxIgYLM9c+OPjiHtoqiR888fDU=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=ST+oYICR80jODpvI6yP12Eod958/ecd8PZTj3IhwUvYjwApAWfJX12vwPul+tp8Wv2ZbvJ4YMAUHL2DLN+2YcX1gfTIgfuWdJFJMKqSTEwhcnsBcnxYRkAPHaO+5yVhdk8VIUeKj21n0wk7s6qlccLe/S9iY2srRRuu6yVOCNJw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=BdMvbBTI; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="BdMvbBTI" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=6JiVxJuhq6r0+1z3RaWhk7CcIwFgTa4P7bMQ8BcxlmI=; b=BdMvbBTInzySenjBubmj0cdNpy vdGdXLGyBqPXbY3F93j7rV5ip25GIdmfUiTlCSnJdZxoKyHM5KtFa/F+HJC9axcqrAh3IN3Bx0CZl cIAQ19PO78oV8wKFWXcDTefE4KmmCl1TcAB2apMrAY1wDVxocr3pCYgU2X1zVKWSab1Jh1+xluW/r EcsRCSSFn/wc1qsJWOPbcxgOyTwbFSIpzNbMFGrl+jnusgYFPqyusZ/zOnF3j56mAHVlrT3Wgc47H QbKpAjSVQELb1Sj4TObx57WJDIH5jDgwmboURDPkHJTY4if8jqRd9GhFxwqyGFNZubcci4I5Ev6oo Maxy9bWA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMh-00000000Lqv-1Xhq; Wed, 02 Sep 2026 00:22:31 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMA-0000000085P-3mr9; Wed, 02 Sep 2026 00:21:58 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:45 -0600 Message-ID: <20260902062153.31048-4-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 03/10] dmaengine: switchtec-dma: fix channel leak on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chans_release() is called in three places but the underlying memory is not freed in all of those places. In order to clean this up, introduce a switchtec_dma_chans_free() helper that will free the memory. Ensure each call to switchtec_dma_chans_release() has a corresponding switchtec_dma_chans_free() call. (The release in switchtec_dma_remove() pairs with the free in switchtec_dma_release()). swdma_dev->chan_cnt is now set to the number of channels that succeeded when one fails to initialise, so switchtec_dma_chans_free() can still be used if not all channels succeed in being allocated. switchtec_dma_chans_free() also removes each channel from dma_dev->channels before freeing it, since the channel status ISR walks that list and would otherwise dereference freed memory. Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initiali= zation and cleanup") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223024.9BB8A1F000E9@smtp.ke= rnel.org Link: https://lore.kernel.org/dmaengine/20260727190604.397DB1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index e55fe9ff7e2c..02d7c38363d6 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1175,6 +1175,18 @@ static int switchtec_dma_chans_release(struct pci_de= v *pdev, return 0; } =20 +static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) +{ + int i; + + for (i =3D 0; i < swdma_dev->chan_cnt; i++) { + list_del(&swdma_dev->swdma_chans[i]->dma_chan.device_node); + kfree(swdma_dev->swdma_chans[i]); + } + + kfree(swdma_dev->swdma_chans); +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1200,7 +1212,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, if (rc) { dev_err(&pdev->dev, "Channel %d: init channel failed\n", i); - chan_cnt =3D i; + swdma_dev->chan_cnt =3D i; goto err_exit; } } @@ -1208,10 +1220,8 @@ static int switchtec_dma_chans_enumerate(struct swit= chtec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: - for (i =3D 0; i < chan_cnt; i++) - switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 return rc; } @@ -1220,12 +1230,8 @@ static void switchtec_dma_release(struct dma_device = *dma_dev) { struct switchtec_dma_dev *swdma_dev =3D container_of(dma_dev, struct switchtec_dma_dev, dma_dev); - int i; =20 - for (i =3D 0; i < swdma_dev->chan_cnt; i++) - kfree(swdma_dev->swdma_chans[i]); - - kfree(swdma_dev->swdma_chans); + switchtec_dma_chans_free(swdma_dev); =20 put_device(dma_dev->dev); kfree(swdma_dev); @@ -1316,6 +1322,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) =20 err_chans_release_exit: switchtec_dma_chans_release(pdev, swdma_dev); + switchtec_dma_chans_free(swdma_dev); =20 err_exit: if (swdma_dev->chan_status_irq) --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B8D139021F; Wed, 2 Sep 2026 06:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; cv=none; b=FPCXb/Gs51V9FqeNG4pGld5XL+zicxWcPot1p8I6HJByIAQCQB4fNBBjJXq0wGhUEF4eTae3+g1xEk6fRdX5mhlxl+ipAAuyXeyIbdXctRnyV+SInuHYCPL+TgQH6Tpfcb1yxbPqBC4W1M9CTO1xShvq39lBnoLK7vBqYE6DTJ0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; c=relaxed/simple; bh=qdDYcnSOorrXrKBtYjag7CrDvCS/HStixo0Rb1+84B0=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=IaMh5B8bPRDEO4VWxM2hm4BUFBF6hZQqWlrDh2W5UaqzeHbtq+HwD6i76ciyTCg6PRYY5HPeA2ZpjwN5ElNxJ6imxY86JyeqgGe++EUZWd3wWQ2O3ZK3xZAAlByPdFH6CZd4VIb6QI/FF6pq9keVsUnLldMBmD4bMXwtvU6aBns= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=PirjzlO7; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="PirjzlO7" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=npqOx2a3pzwUr30QB6cIz89g7iFPtq+ics4J+dr7lHM=; b=PirjzlO7I+SzAMdTebJZDcQgvg Sprh/pQayZYPyUQ2FVhkJWmlcSlrZlh99mHy/uEWBDxBvKqa1BP5UnZGKXpicI2ow4lt3oKKsfvDh uKPUcWxig5TaYzu6RJSof2pPpxJb7JeSu8Nr4OJFqFldtBT/9O80EX3yppE5BG/LNl5vOrl6LKHsK 2gbaajGeQzeaq5jsuiGC7NkZAUj69bAQdk/vPzIEmTS5JqzCga64wu/a3238cLjLnhiTVJhAW/DeH l6cnqclyjJBp3TzXqHdcCmWQNmQ6p+fpXIcoy5M7OdabSuGobQqGayoGUaSfWknvK4n059FHARI0Z VlStcr8Q==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMi-00000000Lr8-0cwY; Wed, 02 Sep 2026 00:22:32 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085R-0B62; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Wed, 2 Sep 2026 00:21:46 -0600 Message-ID: <20260902062153.31048-5-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 04/10] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" switchtec_dma_chans_release() always returned 0, and no caller checked it. Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 02d7c38363d6..17bbf85bcb16 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1164,15 +1164,13 @@ static int switchtec_dma_chan_free(struct pci_dev *= pdev, return 0; } =20 -static int switchtec_dma_chans_release(struct pci_dev *pdev, - struct switchtec_dma_dev *swdma_dev) +static void switchtec_dma_chans_release(struct pci_dev *pdev, + struct switchtec_dma_dev *swdma_dev) { int i; =20 for (i =3D 0; i < swdma_dev->chan_cnt; i++) switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]); - - return 0; } =20 static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev) --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CEAC391825; Wed, 2 Sep 2026 06:22:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330160; cv=none; b=R7oIsm3dfIi3Pc2eLf1Yz7yGHu8RPlLDDRSOPKxaq6SS7bVokcFiJjnWHcXPvYTPFWoHGDO10n7PcxwYQnr1Zw2jC0Eo39VVm5yJ09+H0LFyMpczrts0h02t4AmNhfBdEBCHXNJDad9pKU89nTBXwHJ4xhBiDiSRj+R6RQogPUc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330160; c=relaxed/simple; bh=Ar19r48F3VLMYdlYxLlvsZ7FhNJTUwMLtz+pyd9t6iY=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=EvbCYbGJ3TDfd6CbD9g18kNXYqXgU2y1iytdKK2yU2VjTvKIUhFXufNt0c43duphvLlSXbNtj0VtyPhS/A/J6pVCctwkZO1I4cG9C2335AOdALNLgfoOhsHP3hPiRwlBRX2TwXcjSRblgGyVwTnKP9WzRslr0SjbgxmzdSb0udc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=oF17XNEZ; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="oF17XNEZ" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=jC9vijG6MJHaEkoXhlORlbmD2TAqRZ2zfBTX/nbhhsM=; b=oF17XNEZvO1PczZjZGd9Xsd8/8 7nwmuorCqa8+fSKLm8GLEq9QBAbv1gtEwS9YU6IZFncBAeiFKs76EnLuOf0tJGxe1e9L1k4lsN6qa 9TajSsGCyPEGNvEK9F1Mg7UiMvw/Hi9GLjEpyt/9pNBKfMii0E92iA5xA0PyfZ23KKYRNOIK13G8J ItZjMW+C8Dhff0jzJ9PN20LvOQ5UX0MsdzT6mEoXl2cM5+oaWcJrELxVsIS1UlFXVgsappi4dTHK6 IxsOWiOPmfDWTgswvb8rODZxg/+iMGSKKR5G9rDRKDt8DRFq7K2lEKQOcg936DHExICq8SkHCioDa QNZ2tjig==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMi-00000000LrN-3vkP; Wed, 02 Sep 2026 00:22:33 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085T-0mdV; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:47 -0600 Message-ID: <20260902062153.31048-6-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 05/10] dmaengine: switchtec-dma: fix chan_status_irq cleanup on create() error X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" chan_status_irq stores an MSI-X vector index, but err_exit freed it with plain free_irq() instead of pci_free_irq(), which would free the wrong Linux IRQ. The guard also treated a valid vector index of 0 as unset, skipping the free entirely in that case and leaving the handler registered against soon-to-be-freed swdma_dev. Initialize chan_status_irq to -1 and use the value being non-negative to signal when to free it with pci_free_irq(). Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 17bbf85bcb16..430b09fa5102 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1249,6 +1249,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) if (!swdma_dev) return -ENOMEM; =20 + swdma_dev->chan_status_irq =3D -1; + swdma_dev->bar =3D ioremap(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0)); =20 @@ -1323,8 +1325,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) switchtec_dma_chans_free(swdma_dev); =20 err_exit: - if (swdma_dev->chan_status_irq) - free_irq(swdma_dev->chan_status_irq, swdma_dev); + if (swdma_dev->chan_status_irq >=3D 0) + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); =20 iounmap(swdma_dev->bar); kfree(swdma_dev); --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CE4F394471; Wed, 2 Sep 2026 06:22:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330161; cv=none; b=VyeUoIOCBzXkP9Ac8KxKLSFasuZnlV2e29ptTLS4l01NUCvwihYlet4cpDiFLzqFwAohfKD6H1t6KSpb59By0CuOIUKai+pncf5RR89iuDhVWJzusyv+bGTah8bT6KCvTcU3z8x4b3JhUfgDcAUDFJSx/KnsFjGt8HEHF9sETEw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330161; c=relaxed/simple; bh=ueeILEfETOChpKv0QeX+0zs41WTGkreDGbHyXjGr6rQ=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=FQ9PlPY6m1fLYPT7X97pIr0AlLipfJk+P5Z4hwF8J9QOQuQ97hGd/2rdpy/w5mtXbOTxmMK5K3MXnN7ioxV5awJfNOXof+/1ii37f3HVybFqvmJm+RVW6GC0SrXQvTm5dvDIDPwZ0sYtDh/FGBNdqGdkDhPJHFqIOGcgDsQbpEc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=bFzoS2qo; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="bFzoS2qo" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=m7MdLHFeNb/DeYaGEEoNcHwFln64ruAnhKKUAeOcrWs=; b=bFzoS2qoAh72IqUXJdGdncMP45 zDfXkmokwm1Rgvh++m83R15rXVCgaZ2h20wW63NXugZoRHLj11uxnI0YCyGqbOceE9sX5/MvcbJ2c a+mlxOlChokBYd4K5Pgk3xDuejYtzUEsVLgz17TdEWcKkYCQQhcEc6Vomzo18AKu37X9iuiNcN1O1 JF7feqOQNNzy/KERyHHAF9M3YRtor+nwC+a2H3uG9iZXNwFSF1GezrDPLsESzzI5N9p09uop4egzf 9BJmA6dVSB08J2yVGWD4Z5mO7lZ8YdITZuleTPZjVPodqNvp+LtXwH/bzu17n1sN8U5IfoSRMbQvV bM8nKEBw==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMj-00000000Lre-2x8s; Wed, 02 Sep 2026 00:22:34 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085V-1MlX; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:48 -0600 Message-ID: <20260902062153.31048-7-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 06/10] dmaengine: switchtec-dma: disable channels before freeing on registration failure X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" When switchtec_dma_create() fails after channels have been added to dma_dev->channels (either from switchtec_dma_chans_enumerate()'s own error path, or from dma_async_device_register() failing), the channel status IRQ is still live while the channels are released and freed, so it can fire mid-teardown against channels that are only partially torn down. Add switchtec_dma_chans_disable(), which frees the channel status IRQ before releasing and freeing channels in both error paths. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Link: https://lore.kernel.org/dmaengine/20260721162822.05CDD1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 430b09fa5102..63f80e2a5b6f 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1185,6 +1185,15 @@ static void switchtec_dma_chans_free(struct switchte= c_dma_dev *swdma_dev) kfree(swdma_dev->swdma_chans); } =20 +static void switchtec_dma_chans_disable(struct pci_dev *pdev, + struct switchtec_dma_dev *swdma_dev) +{ + if (swdma_dev->chan_status_irq >=3D 0) { + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); + swdma_dev->chan_status_irq =3D -1; + } +} + static int switchtec_dma_chans_enumerate(struct switchtec_dma_dev *swdma_d= ev, struct pci_dev *pdev, int chan_cnt) { @@ -1218,6 +1227,7 @@ static int switchtec_dma_chans_enumerate(struct switc= htec_dma_dev *swdma_dev, return chan_cnt; =20 err_exit: + switchtec_dma_chans_disable(pdev, swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 @@ -1321,6 +1331,7 @@ static int switchtec_dma_create(struct pci_dev *pdev) return 0; =20 err_chans_release_exit: + switchtec_dma_chans_disable(pdev, swdma_dev); switchtec_dma_chans_release(pdev, swdma_dev); switchtec_dma_chans_free(swdma_dev); =20 --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCFC933DEF7; Wed, 2 Sep 2026 06:22:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330157; cv=none; b=Qzq6bLSep2m0tWgyAP50xsSbL01UJUkiaazOCP4zRWlsAxd6gHgyuC5+rmcT5WEviXuRg8rY193W1vdQbU4GqqbY9goZj9ZSSSkWAFOx+WFlE4YUqj3OlWHcBOOQ0ckIXH1YJQ+Lcz1/o9OwP/R/DpHFnq+ou6U0SVw5A22AT0Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330157; c=relaxed/simple; bh=DHGSX7n6/Yg3OtS2EYXzvdq29UaL9LQaHudjch3YMWw=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=ohtOI1gQrmotAm7NG2dOAlSTaBoxZ5hvoHW7IJI8NF0AWx/unzDtLjdEt57jnV2IkYbwq0+gJ3cM8dHgjWVqP/annWPNpr0xndlRFsmwULNb7Trx7yaCdeEDwB0KMbIgj+xAllUZITx0unvQzmsn3VakGLQdEIoKdRPaPDrc6jQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=aWbUrd5i; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="aWbUrd5i" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=RRyFfGDQohhT4rfzPrUDtiflJzn8pJmWC9W4jZpfcKE=; b=aWbUrd5idOwXHYfoFgudopgKNP epYcxrMnbdlDFWzKGqEpz55JSso5djEnIilbbDTDRD59BnkjDaOMuHyC6eDr+9N7FlY+2j1KF67pj Vo+9wpeNeDAjRC8Yp7RhGFUs4qwTrSQ8r2K1qb7WzJ+C8qSVR3L5MPg8r3ByW8Ed9EWPCJTlOjsIo gfY1+3f1DdRNxfi6BIyvZT1/NpGjqIYRdwsU5EvtXFgsAmk5ZbSy/LBz6rZRFqFszitzQ97jSJPEU loUm03XmQa2oqCUUUnBtFP3cEGJTH44Bx/7VjDFtk+jHiNE23vMI3oXMPlMqIMCibVJPYMFclvKy/ u5JShFyg==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMk-00000000Lrw-2YoT; Wed, 02 Sep 2026 00:22:35 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085X-1vsJ; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:49 -0600 Message-ID: <20260902062153.31048-8-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 07/10] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" dma_async_device_unregister() can drop the last reference on dma_dev and free swdma_dev synchronously via switchtec_dma_release(), but switchtec_dma_remove() then uses swdma_dev->bar for iounmap(). Cache bar in a local variable before the unregister call. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.ke= rnel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/switchtec_dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 63f80e2a5b6f..d390949b843c 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1380,6 +1380,7 @@ static int switchtec_dma_probe(struct pci_dev *pdev, static void switchtec_dma_remove(struct pci_dev *pdev) { struct switchtec_dma_dev *swdma_dev =3D pci_get_drvdata(pdev); + void __iomem *bar =3D swdma_dev->bar; =20 switchtec_dma_chans_release(pdev, swdma_dev); =20 @@ -1392,7 +1393,7 @@ static void switchtec_dma_remove(struct pci_dev *pdev) =20 dma_async_device_unregister(&swdma_dev->dma_dev); =20 - iounmap(swdma_dev->bar); + iounmap(bar); pci_release_mem_regions(pdev); pci_disable_device(pdev); } --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E5D0340DA6; Wed, 2 Sep 2026 06:22:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; cv=none; b=T5t438PPV56cbyrsWCbd5bsKQEV9SjC8QmuvRU8BFdPUfKs5ceeo44oYGnc3N72Q9RzVizMxJZCPhXvWfGkKeB/KWAzXKp/BS5k2tDFUJT7MkksAeyBPBqrBnZqo5VdREKuTZiugj4S077KsdLrzknWmneA78lVXgQMdfXYLvpM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330158; c=relaxed/simple; bh=ZPC6ghhCqsMrK87BUv1t3zX8JsRmF0Kr687Mia/l1FY=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=eeUHMHThw2q7pLylkdLilrsYLRbqAfkUn1+2cu28mZCgYFJtB0E7MVzH76MMhLapaHAXvH/H98FDhSCvaQ/dAt/47F2SKS3oxU200VhxP1VCJruELNwmS19xFaBr/yUOhYdjjQUl7tmZN8yfJZbVXFse/3Ff83DXMhRBCIYldNU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=D9CXPdgo; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="D9CXPdgo" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=hPftQcQVknl4RJ4A76V5p6ISXP3pirJAXoAlUaAoIDM=; b=D9CXPdgoNcsuYZP/N54IcO/dEz yx1cYlMC0qqPOZYV9z3a/6UVN1DG3AwD3Ym5dxoMw3ymCX42F7S0ez2KcX3t+Md36ArAUi9H0upiM 8zFa15PY1/RUhxV0yQZr0Ac2YBnlv/4PryRkjY1fFrUBR+anGYmcQRUY/jFGEkZd2HobKmKbj/u1H z7UaZzDTuXyeSDpithDygKd8jPEUa3w6ol5eHruz3pHC92V/yJIi1LDTIWYl5V244sKBVGOK96u6U 8rxhuxsyneR27/rbsvelPG9vh3YWeGmTFbXC0TFGAqrLbjnXkVsSJdGn4vL4YL/ZkBaLlwlzm+yxE zQYaGNsA==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMl-00000000LsE-1fCJ; Wed, 02 Sep 2026 00:22:36 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085Z-2V8f; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sashiko , Frank Li Date: Wed, 2 Sep 2026 00:21:50 -0600 Message-ID: <20260902062153.31048-9-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, vkoul@kernel.org, sashiko-bot@kernel.org, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 08/10] dmaengine: ioat: disable relaxed ordering before registering the device X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" ioat3_dma_probe() disabled PCIe relaxed ordering after calling dma_async_device_register(), so if an error occurs and the code jumps to err_disable_interrupts, the function returns with the device still registered in the core's dma_device_list while the caller frees the ioatdma_device struct, leaving a dangling registration that anything walking the device list can dereference after it's been freed. Move the capability read/write ahead of dma_async_device_register() instead. Nothing after registration depends on relaxed ordering already being disabled, and nothing before it depends on the device being registered, so this is a plain reordering. It also means every remaining step after registration can't fail, so there's no need to ever have to unregister the device once registered. Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioat= dma") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165906.249F41F000E9@smtp.ke= rnel.org Acked-by: Dave Jiang Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/ioat/init.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 737496391109..a57024c4b066 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat/init.c @@ -1170,15 +1170,6 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } =20 - err =3D dma_async_device_register(&ioat_dma->dma_dev); - if (err) - goto err_disable_interrupts; - - ioat_kobject_add(ioat_dma, &ioat_ktype); - - if (dca) - ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); - /* disable relaxed ordering */ err =3D pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); if (err) { @@ -1194,6 +1185,15 @@ static int ioat3_dma_probe(struct ioatdma_device *io= at_dma, int dca) goto err_disable_interrupts; } =20 + err =3D dma_async_device_register(&ioat_dma->dma_dev); + if (err) + goto err_disable_interrupts; + + ioat_kobject_add(ioat_dma, &ioat_ktype); + + if (dca) + ioat_dma->dca =3D ioat_dca_init(pdev, ioat_dma->reg_base); + if (ioat_dma->cap & IOAT_CAP_DPS) writeb(ioat_pending_level + 1, ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET); --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 531DD3822BE; Wed, 2 Sep 2026 06:22:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; cv=none; b=itdXeWWouNg10KX23UdO5n5lw6bQQnPYIzYvwBBBdr2I+TE+mev6zoX7xycnvk3GSYeX13baOaNsiW49BAy/ivkrY3eiBtd+bqXsxo9FgN4MNTgZncdVCiscJH2uksZof62sYixQ3CQPoI0R1lZvTz080bf600eVbA6MTVWKR7E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330159; c=relaxed/simple; bh=cbKMI/Gfwjo7Isog9AOySnQSoZYzJgpCshFJq+hwjF0=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=q00qcFs6pjpwpqkSZt70ZyNTrSgRtYObusOWpNRuSKQV6wkZty1ZWPpZtcE9ERo+NrFF1VXzz0Xdkv+NJLSE2q6EPfscgb9VJ9HtsWydJVlrW7ty52ZnbIKlPhWRYOnBZYkUN0QtC5rFptYODlElfcWRFx6sQeGN01N3eLrAvlo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=hRBSn+Sy; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="hRBSn+Sy" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=42ekhpUOIdWoqhmhF+8NzZGjM3R4mKuws/+M7N324g4=; b=hRBSn+SyzXZ9BPt3ckYbs2YaqQ ScXy8H5tkYxbTXSMlYbXKk34OHwrdAAp9z/890VgsJlIGcYSF8mZM59BvttR6ESLB2L5a+Uw2qyYB ix76dlc4K0rH9Da6YFrgK9ufQm4UgrqJTSue0+vSYWU5jIjlSmljAWyYNB5ZNh6yEKrtHTmtks9Nc 0I/5ZkA//jdjwSvRJ5smsNRQhDvKCoNlI56qJhhNws2d2GnwrLZ4kA5iYVeXzolkKnA+NTLUWuS7f mwO+NsYhrVCe6sSnzQagyYDFrOrzr17OorrtepDnh64RsZr5z3l3KiR9uMA+us7/zrJX1TlxfhpSo zdOZsy8g==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMm-00000000LsS-10Zq; Wed, 02 Sep 2026 00:22:36 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085b-334W; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Frank Li Date: Wed, 2 Sep 2026 00:21:51 -0600 Message-ID: <20260902062153.31048-10-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, jjy600901@snu.ac.kr, logang@deltatee.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 09/10] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" Convert the sprintf() calls in the per-channel sysfs attribute show() functions to sysfs_emit(). Acked-by: Dave Jiang Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/ioat/sysfs.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/dma/ioat/sysfs.c b/drivers/dma/ioat/sysfs.c index e796ddb5383f..976134df8108 100644 --- a/drivers/dma/ioat/sysfs.c +++ b/drivers/dma/ioat/sysfs.c @@ -24,12 +24,12 @@ static ssize_t cap_show(struct dma_chan *c, char *page) { struct dma_device *dma =3D c->device; =20 - return sprintf(page, "copy%s%s%s%s%s\n", - dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", - dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", - dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", - dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", - dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); + return sysfs_emit(page, "copy%s%s%s%s%s\n", + dma_has_cap(DMA_PQ, dma->cap_mask) ? " pq" : "", + dma_has_cap(DMA_PQ_VAL, dma->cap_mask) ? " pq_val" : "", + dma_has_cap(DMA_XOR, dma->cap_mask) ? " xor" : "", + dma_has_cap(DMA_XOR_VAL, dma->cap_mask) ? " xor_val" : "", + dma_has_cap(DMA_INTERRUPT, dma->cap_mask) ? " intr" : ""); =20 } static const struct ioat_sysfs_entry ioat_cap_attr =3D __ATTR_RO(cap); @@ -39,8 +39,8 @@ static ssize_t version_show(struct dma_chan *c, char *pag= e) struct dma_device *dma =3D c->device; struct ioatdma_device *ioat_dma =3D to_ioatdma_device(dma); =20 - return sprintf(page, "%d.%d\n", - ioat_dma->version >> 4, ioat_dma->version & 0xf); + return sysfs_emit(page, "%d.%d\n", + ioat_dma->version >> 4, ioat_dma->version & 0xf); } static const struct ioat_sysfs_entry ioat_version_attr =3D __ATTR_RO(versi= on); =20 @@ -118,7 +118,7 @@ static ssize_t ring_size_show(struct dma_chan *c, char = *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); + return sysfs_emit(page, "%d\n", (1 << ioat_chan->alloc_order) & ~1); } static const struct ioat_sysfs_entry ring_size_attr =3D __ATTR_RO(ring_siz= e); =20 @@ -127,7 +127,7 @@ static ssize_t ring_active_show(struct dma_chan *c, cha= r *page) struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 /* ...taken outside the lock, no need to be precise */ - return sprintf(page, "%d\n", ioat_ring_active(ioat_chan)); + return sysfs_emit(page, "%d\n", ioat_ring_active(ioat_chan)); } static const struct ioat_sysfs_entry ring_active_attr =3D __ATTR_RO(ring_a= ctive); =20 @@ -135,7 +135,7 @@ static ssize_t intr_coalesce_show(struct dma_chan *c, c= har *page) { struct ioatdma_chan *ioat_chan =3D to_ioat_chan(c); =20 - return sprintf(page, "%d\n", ioat_chan->intr_coalesce); + return sysfs_emit(page, "%d\n", ioat_chan->intr_coalesce); } =20 static ssize_t intr_coalesce_store(struct dma_chan *c, const char *page, --=20 2.47.3 From nobody Sat Sep 26 11:01:10 2026 Received: from ale.deltatee.com (ale.deltatee.com [204.191.154.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC614378828; Wed, 2 Sep 2026 06:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=204.191.154.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330160; cv=none; b=ZIPWGkiXf1EAd9QoEahI/JrchT7OIfMF8h2QjJgQao2T0t6fO8UJ3wgHYi7pD4AQ4q2YJrulVcY0V//t/a75vRngx0nUuafZjKwGfwUJE7u2h5yNXbIWn1FeSBdv1BelQ3CudSFpj6pwwm4gM4CK9qq//ZzwbdOy69Nqm4GOjqs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788330160; c=relaxed/simple; bh=J5Z+negq9t0hkOPhOevbAhPTgwWt6tQSntxeoP4sOG4=; h=From:To:Cc:Date:Message-ID:In-Reply-To:References:MIME-Version: Subject; b=UbqOxgsLO+36JBp/Wyqr0QeKTVuuTNi7C4ZiZZORT0j1ToHG1HNEwVPPRg6y9v3ddOj+qstQIXPhRCy4PERVCRRhko5kYlx0ciKtFQJp0Hy8VMFQgY1XN5VIM7/kYBXiu+kqNbPOk3hj/hlszLTX/Fjv7EX/OgbiOGHaJbshLUE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com; spf=pass smtp.mailfrom=deltatee.com; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b=meeK04u3; arc=none smtp.client-ip=204.191.154.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=deltatee.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=deltatee.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=deltatee.com header.i=@deltatee.com header.b="meeK04u3" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=deltatee.com; s=20200525; h=Subject:MIME-Version:References:In-Reply-To: Message-ID:Date:Cc:To:From:content-disposition; bh=RnnO1NNcjLe9HNz+vfdGpNqTtaHUrE/25DnSIreOxdA=; b=meeK04u33NQSRXZYGdXS7yvEII j8CXD2cEdJJ14gUaunkwF8a3eTTuJIy+wlFk44OoCJudS1slAT6N/gIuSd6oJf819PZQynmtzM6ay tSUdpCpbfdA5s8SoPxEDcEgBhvmIsqKhgBO3DtlzXn54Xid1r3N9ZRbDTMfkSfqmmS3jwdAzzwTCd wZ65BowY+cjW7+H+fISAs79MbWJnxer52HvzSdRnlDI9vfPT9WjGdboIdc6KUBvtY7BcBls+NxULz YcqFMtlgtctslIrAEiE4lUQzJymLdWayLOl9WsqcON/nYpIQzb0XqI2XObpofIU/dfhPdx8dalhz8 uMNc+wEQ==; Received: from cgy1-donard.priv.deltatee.com ([172.16.1.31]) by ale.deltatee.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1x1eMn-00000000Lsk-1gJw; Wed, 02 Sep 2026 00:22:37 -0600 Received: from gunthorp by cgy1-donard.priv.deltatee.com with local (Exim 4.98.2) (envelope-from ) id 1x1eMB-0000000085d-3cIr; Wed, 02 Sep 2026 00:21:59 -0600 From: Logan Gunthorpe To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, Vinod Koul Cc: Frank Li , Kelvin Cao , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Dave Jiang , George Ge , Jaeyoung Chung , Logan Gunthorpe , Sangyun Kim , Kyungwook Boo , Frank Li Date: Wed, 2 Sep 2026 00:21:52 -0600 Message-ID: <20260902062153.31048-11-logang@deltatee.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260902062153.31048-1-logang@deltatee.com> References: <20260902062153.31048-1-logang@deltatee.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SA-Exim-Connect-IP: 172.16.1.31 X-SA-Exim-Rcpt-To: linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org, dmaengine@vger.kernel.org, vkoul@kernel.org, linux@weissschuh.net, dave.jiang@intel.com, kelvin.cao@microchip.com, george.ge@microchip.com, logang@deltatee.com, jjy600901@snu.ac.kr, sangyun.kim@snu.ac.kr, bookyungwook@gmail.com, Frank.li@nxp.com, Frank.Li@nxp.com X-SA-Exim-Mail-From: gunthorp@deltatee.com X-Spam-Level: Subject: [PATCH v6 10/10] dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr() X-SA-Exim-Version: 4.2.1 (built Sun, 23 Feb 2025 07:57:16 +0000) X-SA-Exim-Scanned: Yes (on ale.deltatee.com) Content-Type: text/plain; charset="utf-8" plx_dma_create() registered the interrupt handler with request_irq() before initializing plxdev->bar. If the device raised an interrupt in that window, plx_dma_isr() would dereference the still-NULL bar. Move the bar assignment ahead of request_irq() so everything the handler can touch is initialized before it can run. Reported-by: Sangyun Kim Reported-by: Kyungwook Boo Link: https://lore.kernel.org/all/20260610112121.676561-1-jjy600901@snu.ac.= kr Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization= and cleanup") Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe --- drivers/dma/plx_dma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c index 84941a918b01..409898e92c32 100644 --- a/drivers/dma/plx_dma.c +++ b/drivers/dma/plx_dma.c @@ -504,17 +504,17 @@ static int plx_dma_create(struct pci_dev *pdev) if (!plxdev) return -ENOMEM; =20 - rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, - KBUILD_MODNAME, plxdev); - if (rc) - goto free_plx; - spin_lock_init(&plxdev->ring_lock); tasklet_setup(&plxdev->desc_task, plx_dma_desc_task); =20 RCU_INIT_POINTER(plxdev->pdev, pdev); plxdev->bar =3D pcim_iomap_table(pdev)[0]; =20 + rc =3D request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0, + KBUILD_MODNAME, plxdev); + if (rc) + goto free_plx; + dma =3D &plxdev->dma_dev; INIT_LIST_HEAD(&dma->channels); dma_cap_set(DMA_MEMCPY, dma->cap_mask); --=20 2.47.3