* [PATCH] dmaengine: mv_xor: kill tasklet on channel add error path
@ 2026-09-09 23:46 Rosen Penev
2026-09-10 1:31 ` Frank Li
0 siblings, 1 reply; 2+ messages in thread
From: Rosen Penev @ 2026-09-09 23:46 UTC (permalink / raw)
To: dmaengine
Cc: Vinod Koul, Frank Li, Saeed Bishara, Dan Williams,
Maciej Sosnowski, Nicolas Pitre, Lennert Buytenhek, open list
If request_irq() succeeds but a later step (self-test or device
registration) fails, the error path at err_free_irq frees the IRQ
but does not kill the tasklet. A previously scheduled tasklet can
still run after the channel is freed, accessing freed memory.
Add tasklet_kill() after free_irq() on the error path.
Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/dma/mv_xor.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 25ed61f1b089..24f22db5dfa1 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1162,6 +1162,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
err_free_irq:
free_irq(mv_chan->irq, mv_chan);
+ tasklet_kill(&mv_chan->irq_tasklet);
err_free_dma:
dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] dmaengine: mv_xor: kill tasklet on channel add error path
2026-09-09 23:46 [PATCH] dmaengine: mv_xor: kill tasklet on channel add error path Rosen Penev
@ 2026-09-10 1:31 ` Frank Li
0 siblings, 0 replies; 2+ messages in thread
From: Frank Li @ 2026-09-10 1:31 UTC (permalink / raw)
To: Rosen Penev
Cc: dmaengine, Vinod Koul, Frank Li, Saeed Bishara, Dan Williams,
Maciej Sosnowski, Nicolas Pitre, Lennert Buytenhek, open list
On Wed, Sep 09, 2026 at 04:46:01PM -0700, Rosen Penev wrote:
> If request_irq() succeeds but a later step (self-test or device
> registration) fails, the error path at err_free_irq frees the IRQ
> but does not kill the tasklet. A previously scheduled tasklet can
> still run after the channel is freed, accessing freed memory.
>
> Add tasklet_kill() after free_irq() on the error path.
>
> Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> drivers/dma/mv_xor.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
> index 25ed61f1b089..24f22db5dfa1 100644
> --- a/drivers/dma/mv_xor.c
> +++ b/drivers/dma/mv_xor.c
> @@ -1162,6 +1162,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
>
> err_free_irq:
> free_irq(mv_chan->irq, mv_chan);
> + tasklet_kill(&mv_chan->irq_tasklet);
> err_free_dma:
> dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
> mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
> --
> 2.55.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-10 1:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 23:46 [PATCH] dmaengine: mv_xor: kill tasklet on channel add error path Rosen Penev
2026-09-10 1:31 ` Frank Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®