[PATCH] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources

[PATCH] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources

[Rosen Penev]

fsl_re_free_chan_resources() loops alloc_count times calling
list_first_entry() on free_q without checking whether the list still
has entries. If descriptors remain un-acked or pending in submit_q /
active_q / ack_q when the channel resources are freed, free_q becomes
smaller than alloc_count and list_first_entry() returns the list head,
causing list_del() to corrupt the list head and dereference a bogus
pointer.

Walk free_q with list_for_each_entry_safe() until it is empty,
decrementing alloc_count per freed descriptor, instead of relying on
the alloc_count count.

Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/fsl_raid.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index 30aaca81d855..db86f3e4e460 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -614,18 +614,15 @@ static int fsl_re_alloc_chan_resources(struct dma_chan *chan)
 static void fsl_re_free_chan_resources(struct dma_chan *chan)
 {
 	struct fsl_re_chan *re_chan;
-	struct fsl_re_desc *desc;
+	struct fsl_re_desc *desc, *_desc;
 
 	re_chan = container_of(chan, struct fsl_re_chan, chan);
-	while (re_chan->alloc_count--) {
-		desc = list_first_entry(&re_chan->free_q,
-					struct fsl_re_desc,
-					node);
-
+	list_for_each_entry_safe(desc, _desc, &re_chan->free_q, node) {
 		list_del(&desc->node);
 		dma_pool_free(re_chan->re_dev->cf_desc_pool, desc->cf_addr,
 			      desc->cf_paddr);
 		kfree(desc);
+		re_chan->alloc_count--;
 	}
 
 	if (!list_empty(&re_chan->free_q))
-- 
2.55.0

Re: [PATCH] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources

[Frank Li]

On Sat, Jul 18, 2026 at 04:52:27PM -0700, Rosen Penev wrote:
> fsl_re_free_chan_resources() loops alloc_count times calling
> list_first_entry() on free_q without checking whether the list still
> has entries. If descriptors remain un-acked or pending in submit_q /
> active_q / ack_q when the channel resources are freed, free_q becomes
> smaller than alloc_count and list_first_entry() returns the list head,
> causing list_del() to corrupt the list head and dereference a bogus
> pointer.
>
> Walk free_q with list_for_each_entry_safe() until it is empty,
> decrementing alloc_count per freed descriptor, instead of relying on
> the alloc_count count.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/fsl_raid.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index 30aaca81d855..db86f3e4e460 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -614,18 +614,15 @@ static int fsl_re_alloc_chan_resources(struct dma_chan *chan)
>  static void fsl_re_free_chan_resources(struct dma_chan *chan)
>  {
>  	struct fsl_re_chan *re_chan;
> -	struct fsl_re_desc *desc;
> +	struct fsl_re_desc *desc, *_desc;
>
>  	re_chan = container_of(chan, struct fsl_re_chan, chan);
> -	while (re_chan->alloc_count--) {
> -		desc = list_first_entry(&re_chan->free_q,
> -					struct fsl_re_desc,
> -					node);
> -
> +	list_for_each_entry_safe(desc, _desc, &re_chan->free_q, node) {
>  		list_del(&desc->node);
>  		dma_pool_free(re_chan->re_dev->cf_desc_pool, desc->cf_addr,
>  			      desc->cf_paddr);
>  		kfree(desc);
> +		re_chan->alloc_count--;
>  	}
>
>  	if (!list_empty(&re_chan->free_q))
> --
> 2.55.0
>

Re: [PATCH] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources

[Vinod Koul]

On Sat, 18 Jul 2026 16:52:27 -0700, Rosen Penev wrote:
> fsl_re_free_chan_resources() loops alloc_count times calling
> list_first_entry() on free_q without checking whether the list still
> has entries. If descriptors remain un-acked or pending in submit_q /
> active_q / ack_q when the channel resources are freed, free_q becomes
> smaller than alloc_count and list_first_entry() returns the list head,
> causing list_del() to corrupt the list head and dereference a bogus
> pointer.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources
      commit: d805aa5b6088b193debabaa80cc0991bfa2bd057

Best regards,
-- 
~Vinod