Re: [PATCH v4 04/24] dmaengine: dw-edma: Make DMA link list work as a circular buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Hardware abort interrupt silently stalls pending descriptors and sets channel to IDLE, risking use-after-free on subsequent transfers
--

--- Patch [4]: [PATCH v4 04/24] dmaengine: dw-edma: Make DMA link list work as a circular buffer ---
commit e57484a362fa80a92a80a905cb57fb2805286319
Author: Frank Li <Frank.Li@nxp.com>
dmaengine: dw-edma: Make DMA link list work as a circular buffer

This commit modifies the driver to operate the DMA linked list as a
circular ring buffer instead of rebuilding it per transfer. It also adds
ring resets after channel stops to prevent inheriting occupied slots.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index 6a25a050b89c4..d7a8a43b71d64 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
[ ... ]
> @@ -685,6 +748,8 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
>  		list_del(&vd->node);
>  		vchan_cookie_complete(vd);
>  	}
> +	if (!chan->non_ll)
> +		dw_edma_core_reset_ll(chan);
>  	chan->request = EDMA_REQ_NONE;
>  	chan->status = EDMA_ST_IDLE;
>  	spin_unlock_irqrestore(&chan->vc.lock, flags);

[Severity: High]
This is a pre-existing issue, but does dw_edma_abort_interrupt() leave stale
descriptors in the desc_issued queue?

When a hardware abort interrupt occurs, the active descriptor is aborted
and removed, but the remaining queued descriptors are not flushed. Since
the channel status is set directly to EDMA_ST_IDLE, will a subsequent
dma_async_issue_pending() silently resume executing these stale descriptors?

If a client assumed the batch was canceled and freed the memory, would
the DMA engine accessing these leftover descriptors cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729143036.3087722-1-den@valinux.co.jp?part=4