Re: [PATCH 5/7] dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory

[Frank Li <Frank.li@oss.nxp.com>]

On Sun, Oct 18, 2026 at 12:07:21PM +0800, Jiale Yao wrote:
> The XOR interrupt handler schedules irq_tasklet to clean channel
> descriptor lists. Both device removal and late channel setup failures
> can free the coherent descriptor pool while a previously queued tasklet
> still refers to it.
>
> Release the IRQ first so no new tasklet can be queued, kill the tasklet,
> and only then free the descriptor pool and DMA mappings.
>
> Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/mv_xor.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
> index 25ed61f1b089..ec746cd16960 100644
> --- a/drivers/dma/mv_xor.c
> +++ b/drivers/dma/mv_xor.c
> @@ -1013,6 +1013,9 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
>
>  	dma_async_device_unregister(&mv_chan->dmadev);
>
> +	free_irq(mv_chan->irq, mv_chan);
> +	tasklet_kill(&mv_chan->irq_tasklet);
> +
>  	dma_free_wc(dev, MV_XOR_POOL_SIZE,
>  			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
>  	dma_unmap_single(dev, mv_chan->dummy_src_addr,
> @@ -1025,8 +1028,6 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
>  		list_del(&chan->device_node);
>  	}
>
> -	free_irq(mv_chan->irq, mv_chan);
> -
>  	return 0;
>  }
>
> @@ -1162,6 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
>
>  err_free_irq:
>  	free_irq(mv_chan->irq, mv_chan);
> +	tasklet_kill(&mv_chan->irq_tasklet);
>  err_free_dma:
>  	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
>  			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
> --
> 2.34.1
>