Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout

[Frank Li <Frank.li@oss.nxp.com>]

On Fri, Oct 30, 2026 at 02:39:45PM +0000, Samarth Narang wrote:
> [You don't often get email from samarth.colleges@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
> the operation's buffers and returns -ETIMEDOUT without stopping the APBH
> DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
> pending descriptor chain may resume after the timeout, while a
> subsequent operation can append new descriptors to the stale chain and
> cause the old DATA_IN transfer to execute again against an unmapped
> buffer.
>
> This can result in DMA writes to memory that has already been released,
> including buffers freed after ONFI parameter page detection in
> nand_onfi_detect().
>
> Terminate the channel with dmaengine_terminate_sync() before unmapping
> so that outstanding transfers are stopped and subsequent operations
> begin with a fresh descriptor chain.
>
> Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
> Assisted-by: LLM
> Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> This issue was identified by a research static analyzer for DMA
> lifecycle ordering and has not been validated on hardware.
> Compile-tested only.
>
>  drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c |    2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
>         if (!to) {
>                 dev_err(this->dev, "DMA timeout, last DMA\n");
>                 gpmi_dump_info(this);
> +               /* Retire the APBH chain before its buffers are unmapped. */
> +               dmaengine_terminate_sync(get_dma_chan(this));
>                 ret = -ETIMEDOUT;
>                 goto unmap;
>         }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
>