From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C7D637E301 for ; Thu, 11 Jun 2026 21:07:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781212069; cv=none; b=szUZdCB6YhtLETYwYyuRSkU8lsYpZb5UIgfZVV4AVKT95+kqIlSpL9nGkvaZQT6ZjhUy5g2MmzAH2k/N/ZwqXm7fVWLPUL8oMOOeyrKKzsRL1uS/c9eK/L6Y/er6RdY4mTtofXBVTzwPcpg8BGSuPOy+1Okn3FMmlbUbByI0lM4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781212069; c=relaxed/simple; bh=5JoLRCeu+E2PnWKzUKkkD/JB9XvHf6wbdyGdGBkGj7Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mrKi96R5Z5wJGb73UAy9QPtbZDxXj3LWj0iTYodCoNa7j7BVDMuO36QQRgF+zVb+TxJi1XTJXPGxiMBU6yccYqhqerTfZzrASPkts9xPGrhBZGYAVd1z6G0rvNOmcYPJMT+uVc21fL6Q0dc+Oay8EapjEUB8YSjM2J9YItPLNic= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WK9Exm8l; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WK9Exm8l" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2c0c2c7e0c5so2097505ad.1 for ; Thu, 11 Jun 2026 14:07:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781212065; x=1781816865; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=GIlS0gTD7wW7yJLvROv1DCGaq5p/ibohnBpYCwWAhP0=; b=WK9Exm8ltscuND5mmJYCYRlpUyKVFFMyVR6JYP2ZYBBlRTQ9G2Q7mojPIw8QjKvh5l 0FSxHFfYLnXRLa6+moUcXYdrEAYaF6+/jV063zKQRkMkiwROhRJR/swUXvsH1WrfKOaj TEILqwZPLAKou5a4LDV6I/I8C8jAriTckp0D+wJU6aKgkuh0SmDW6MQxICnvrhRvwgWt Czw9rniTLqufzvPimkzN7ETRYiU//++UyyZILq9P18eOHyNYZurgtlm9G3MkTUlpdL8+ 6SQLd2u7NEJGySGwOYHRPriEzYYOj8JlLOYcUvIHB2/wjORA1zHTrJR5UMUonxqBKa1P zosg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781212065; x=1781816865; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=GIlS0gTD7wW7yJLvROv1DCGaq5p/ibohnBpYCwWAhP0=; b=LKyDnJigl1MNqXsdHbGz7zdurqlQwoE2miKsu97fvuicXGHU7ZntxGususV0bFsj3I 6zWzs1yTcGoo03LT/ANGpQH9TpWyxlydpTyVwQiQ4tlB1gB1mCko3jIGzCNzXChC8CPg H4o+pUc7jKI6mG+4e69QSsHHi2uupKff4vLs/vd1HFus9KgWtXCwbpIaImCVs/2NMmGG YzEnfgVsozuF8GINdxiFPnG1muWRfqfyJMt0kQfnzX35g32sEmdBxXlq23fa5wlKJr42 I/tRFR4JmPH095yvdUNQSF4YxKzB+K4/vur/ZfMhLMXdUhLUYpfdS922MJGAOVruT1Ls OMsA== X-Forwarded-Encrypted: i=1; AFNElJ+XNJJEr3SN/UcRKoP20XE7SLK6+1ZiRfpAXIS/B2X58xBJVgC+4kkRzQOij/X0PhX1jnKQ8ROM79Rozms=@vger.kernel.org X-Gm-Message-State: AOJu0YztLrvi1hooDKJxvaLrpZgZzrLLlHTRHF85b1/vf5ntk2bAaZ9w MhoBCfKvSyo482mZY/JFmtl1YrXQJjSOUpms3lAmQPjld2DTymMWypcu X-Gm-Gg: Acq92OHLY7PQX1z4piq1HLVO8kQIx7OwUrVKuIkSR8638Sxx/cBSRogb1BWKxxiLhIA o6nfXIrtvZqKE6EsdmiLwadkum8Enzv/scY9Qfy6RI7giqHFYryjOEnCXdQXAlqdhu8zQuDvVso ffeC1N+C1mHKOVBGXwNSIGtId2dIILbEq0na11BcmLPqOHS3RKEWWGcqGKIh3/Ae6LpXy9oSVtr xZOdcQyfKKZOlPmXIWocSLHlR3RthgvrwX5zKlEufcz6wh44S3hGmxEnookH5X7WUdVFfcb0cOA KLyRoZgGXA4be/4RMFLuhZt0R1tc8YdtSEDFgKI9k0zj7nb0chpf5hEto2+EvhMEW3xvQ/KKric rIMn2bJoQ5pvKKHIRJw7Sec6B/uNq3nZSY/06FwUfGQLz5BmW4O+VMfxmKsvqtuMbnb3f8TQ/U0 8jkJijRz0LAIvLY7SUCkGFThEP7NWs1lLk+Lz3nzsFdOybymgylrerpNNUiEtvx6RcbBVNOSZTt xar0QOi7chPRZN7bersJwKwy3shgewZ7RE= X-Received: by 2002:a17:903:120e:b0:2be:3434:4e28 with SMTP id d9443c01a7336-2c411c79bf3mr895955ad.19.1781212065249; Thu, 11 Jun 2026 14:07:45 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:6d3a:64fc:4ee8:9cc3]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c411d79289sm389995ad.14.2026.06.11.14.07.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Jun 2026 14:07:44 -0700 (PDT) From: Rosen Penev To: dmaengine@vger.kernel.org Cc: Vinod Koul , Frank Li , Thomas Petazzoni , Gregory CLEMENT , Marcin Wojtas , Rob Herring , linux-kernel@vger.kernel.org (open list) Subject: [PATCHv2 4/9] dmaengine: mv_xor: abort channel before freeing resources on timeout Date: Thu, 11 Jun 2026 14:07:16 -0700 Message-ID: <20260611210721.81979-5-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260611210721.81979-1-rosenp@gmail.com> References: <20260611210721.81979-1-rosenp@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In mv_chan_memcpy_self_test() and mv_chan_xor_self_test(), if the DMA operation times out (status check returns !DMA_COMPLETE), the code jumps to free_resources which unmaps DMA buffers, frees the descriptor pool, and releases the source/destination pages without ever stopping the hardware channel. The DMA engine may still be executing and could DMA into the freed destination pages, corrupting kernel memory. Add mv_chan_disable() which masks interrupts and clears the activation register to abort any in-flight operation. Call it in the self-test error paths before freeing resources, and also at the top of mv_xor_free_chan_resources() to protect clients that release the channel while DMA is active. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/dma/mv_xor.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c index 588af337afe3..44a7d4f7fb0d 100644 --- a/drivers/dma/mv_xor.c +++ b/drivers/dma/mv_xor.c @@ -169,6 +169,12 @@ static void mv_chan_activate(struct mv_xor_chan *chan) writel(BIT(0), XOR_ACTIVATION(chan)); } +static void mv_chan_disable(struct mv_xor_chan *chan) +{ + mv_chan_mask_interrupts(chan); + writel_relaxed(0, XOR_ACTIVATION(chan)); +} + static char mv_chan_is_busy(struct mv_xor_chan *chan) { u32 state = readl_relaxed(XOR_ACTIVATION(chan)); @@ -638,6 +644,8 @@ static void mv_xor_free_chan_resources(struct dma_chan *chan) struct mv_xor_desc_slot *iter, *_iter; int in_use_descs = 0; + mv_chan_disable(mv_chan); + spin_lock_bh(&mv_chan->lock); mv_chan_slot_cleanup(mv_chan); @@ -854,7 +862,7 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan) dev_err(dma_chan->device->dev, "Self-test copy timed out, disabling\n"); err = -ENODEV; - goto free_resources; + goto free_chan; } dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma, @@ -863,9 +871,11 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan) dev_err(dma_chan->device->dev, "Self-test copy failed compare, disabling\n"); err = -ENODEV; - goto free_resources; + goto free_chan; } +free_chan: + mv_chan_disable(mv_chan); free_resources: dmaengine_unmap_put(unmap); mv_xor_free_chan_resources(dma_chan); @@ -987,7 +997,7 @@ mv_chan_xor_self_test(struct mv_xor_chan *mv_chan) dev_err(dma_chan->device->dev, "Self-test xor timed out, disabling\n"); err = -ENODEV; - goto free_resources; + goto free_chan; } dma_sync_single_for_cpu(dma_chan->device->dev, dest_dma, @@ -999,10 +1009,12 @@ mv_chan_xor_self_test(struct mv_xor_chan *mv_chan) "Self-test xor failed compare, disabling. index %d, data %x, expected %x\n", i, ptr[i], cmp_word); err = -ENODEV; - goto free_resources; + goto free_chan; } } +free_chan: + mv_chan_disable(mv_chan); free_resources: dmaengine_unmap_put(unmap); mv_xor_free_chan_resources(dma_chan); @@ -1020,6 +1032,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan) struct device *dev = mv_chan->dmadev.dev; mv_chan_mask_interrupts(mv_chan); + mv_chan_disable(mv_chan); tasklet_kill(&mv_chan->irq_tasklet); dma_async_device_unregister(&mv_chan->dmadev); -- 2.54.0