From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D97FB2F6911 for ; Thu, 21 May 2026 14:48:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374884; cv=none; b=sQkT0kUQDcJtYpT0rvU0XUExhLm9PGQ8hwvkAyVaFsrB2EXGDSmv27EKAsxJsOB+NweLVqXwfzYIUFRh7W7PQ9qG9IpJZcMvb6qA+ag4OOvE9dEUXuUgXu2O1kWuqwkwqdufbCi3hQQ9kbG5rG0gmFrBf5ku3LDqajAtbhlED+s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374884; c=relaxed/simple; bh=EX9iuFe2HivKCwOTaxCINsh3UzE2ULn9Ke1iwK2Idbg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ORiRmjS7ato4Xxy5W3LhUbpBp/KwJvlcy0lCyJNsC1Ll7ErsyPV5T95kLDPoG5n0bdFR1TYK6OPi0cEW00O7J64lbT1LTWZsrOdve0BaVPkEB2tuBUtg3U+hDarMdbJD72ZYniAsWHPWdDo20bMjUBtKayrCeKjGzMXcGdFV10Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Bcdbmhcp; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Bcdbmhcp" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-36900945df5so3162584a91.0 for ; Thu, 21 May 2026 07:48:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779374882; x=1779979682; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4mtwRPah/bLATx6RFt0C3QCf1Zldq1D4z7+HKhDsfT0=; b=BcdbmhcpIg3BmHtFuL7hjmv3fUftzTae5zUPCgAjfG7w50/w9iAjCu/lBYzHSyS4r2 Vo285i6VJox1jj2g5ISCHMDFCNgUBCl4EMRZvdAFQEzmBigDGFNdtHePLP77YNRCOh3C PI0kSc50VYIHnRYpdWkfKaYZzgRal2I6SH6WrR9YE6pAoxLg71dYYvTFZkRNo/1VHtZm oqLednpGUpGL/E/2yxJUDkM8eydNVenVl3zv3+7W5QEH9UwcO1hKOndIHbKxQPQnDIPg fTCSEiRK4b85wFgjWhEZ+pK6xBQswzwG8Yv2K6Gp532LGAQTv/ioTx9MOAklyvT43wem 3S7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779374882; x=1779979682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4mtwRPah/bLATx6RFt0C3QCf1Zldq1D4z7+HKhDsfT0=; b=WvteocjkG0gI5U7x4xahRyLkAOxHT2w1SdAJmVPLHNyLQGMRQeTv3Y/y9LVvXhZ8F9 zh6k/be5t4GinBJY/P17eBnYt/PKixCq1fbFxMtD4WhvyKGTOWvLoHvDM6xOOrs/AZ5W wNbIOFrLfMnLP6eLpDqVTJiWTqlTlPjQhOzOeCD3eREa9l8CxxHXdPXbix3KLs00aAFF XFNxWqzun9O4fOz7l7+SsywroBhQo6ZABuX0eyoKElcxK9nwgjDHUxzMsUkXkQqYdnta HZ7IT0y0xkS2jvBjU7VFi4gj3UccCwI3tIeMmU9clagW/M3kzsZNr2mAeoU3pm07MmF/ Xm4g== X-Forwarded-Encrypted: i=1; AFNElJ8FcqiX1aLazy/gXUD7Ql25ItTuX4D/r5x38fJv2bYCKO+0bjL88mfnzhRWIulPih4PrLkcNgfAe30gOeg=@vger.kernel.org X-Gm-Message-State: AOJu0YzUEUjue/Wsq5XYttn+Ra5/wWZYhTq6bsCB0hu9aKyB9pTFE7gT Ci9f3d0qerf8LzHZV7F4BwkMZdm3EyHUhs8q1T6HzvZlQEmBS/mrmtrM X-Gm-Gg: Acq92OELQHTJZfAEDMPWrutafIrsqxi9sgV9rYzllii3YtKs/7gkFsRHhAJAFldkdTA hiqJg2UQ28d14mwei/OUvpoAer3ixl2XNsTZNjqPGu9NTzKVCZo52ueiz3jVjWfFE+KswbqFAGk /uR20R1hRd9g28x4QvSHHh3ThgKu1qYoYi1vEObTJmLP3PPHiPlWmOpcOmhUiiBlp7WuZ3kbpTJ dPPnPzA23y2id02iJgByhQU1J/Cu9UO6PWAvgs0q3CyjGhlMn+TraLBneu2cmcRp9kdQZKHpsZZ fsoDZl2wXn40SzRVjqDQpU0oxfEwS9oWZ5AmuexGrlD+NdBbQDJSeoU1Ic0G2rdjdI1Mp86H0EW +LdUMyZOr1SEsnNJ/kNZLUmMlBSla3+dDxbLHV0uaKdUHRTKiE0rjPAuSUec9eht+GkyHbmo/lo iT1o9TPXGQ1MTXueOxUQmZAmSIJmnNxg69WbeCVjanUKseUPRSBZDkdRy5Kf0= X-Received: by 2002:a17:90b:2f8d:b0:36a:31c2:d402 with SMTP id 98e67ed59e1d1-36a451592edmr3478966a91.10.1779374882162; Thu, 21 May 2026 07:48:02 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36a3cc5643dsm3773472a91.7.2026.05.21.07.47.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 07:48:01 -0700 (PDT) From: Maoyi Xie To: Vinod Koul Cc: Frank Li , Geert Uytterhoeven , dmaengine@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] dmaengine: mpc512x: fix dead empty check in mpc_dma_prep_slave_sg() Date: Thu, 21 May 2026 22:47:54 +0800 Message-Id: <20260521144755.3476353-2-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260521144755.3476353-1-maoyixie.tju@gmail.com> References: <20260521144755.3476353-1-maoyixie.tju@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mpc_dma_prep_slave_sg() reads mchan->free with list_first_entry() and then tests the returned pointer against NULL. list_first_entry() never returns NULL. On an empty free list it returns container_of(&mchan->free, struct mpc_dma_desc, node), an aliased pointer derived from the list head. The recovery path (drop lock, scan completed list, return NULL) is dead code. If the free list is ever empty here, the aliased mdesc points at &mchan->free. The list_del(&mdesc->node) that follows then runs on the head itself, corrupting mchan->free.next and mchan->free.prev. The free list is reachable empty when the descriptor pool is exhausted. The author intent was clear from the recovery path: release the lock, scan the completed list to free descriptors, and return NULL so the caller can retry. Use list_first_entry_or_null() so the empty case returns NULL and the existing recovery path runs as intended. The same shape has been cleaned up elsewhere, for example in commit fbb8bc408027 ("net: qed: Remove redundant NULL checks after list_first_entry()"), commit c708d3fad421 ("crypto: atmel - use list_first_entry_or_null to simplify find_dev"), and commit 10379171f346 ("ksmbd: use list_first_entry_or_null for opinfo_get_list()"). This site was missed by those cleanups. Signed-off-by: Maoyi Xie --- drivers/dma/mpc512x_dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/mpc512x_dma.c b/drivers/dma/mpc512x_dma.c index 0adc8e01057e..f5934136efc4 100644 --- a/drivers/dma/mpc512x_dma.c +++ b/drivers/dma/mpc512x_dma.c @@ -706,8 +706,8 @@ mpc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, for_each_sg(sgl, sg, sg_len, i) { spin_lock_irqsave(&mchan->lock, iflags); - mdesc = list_first_entry(&mchan->free, - struct mpc_dma_desc, node); + mdesc = list_first_entry_or_null(&mchan->free, + struct mpc_dma_desc, node); if (!mdesc) { spin_unlock_irqrestore(&mchan->lock, iflags); /* Try to free completed descriptors */ -- 2.34.1