* [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
@ 2026-10-30 14:39 ` Samarth Narang
0 siblings, 0 replies; 6+ messages in thread
From: Samarth Narang @ 2026-10-30 14:39 UTC (permalink / raw)
To: Han Xu, Miquel Raynal, Vignesh Raghavendra
Cc: Richard Weinberger, imx, linux-mtd, linux-kernel, Samarth Narang
When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
the operation's buffers and returns -ETIMEDOUT without stopping the APBH
DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
pending descriptor chain may resume after the timeout, while a
subsequent operation can append new descriptors to the stale chain and
cause the old DATA_IN transfer to execute again against an unmapped
buffer.
This can result in DMA writes to memory that has already been released,
including buffers freed after ONFI parameter page detection in
nand_onfi_detect().
Terminate the channel with dmaengine_terminate_sync() before unmapping
so that outstanding transfers are stopped and subsequent operations
begin with a fresh descriptor chain.
Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
Assisted-by: LLM
Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
---
This issue was identified by a research static analyzer for DMA
lifecycle ordering and has not been validated on hardware.
Compile-tested only.
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 527165ccc..a8106de2c 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
if (!to) {
dev_err(this->dev, "DMA timeout, last DMA\n");
gpmi_dump_info(this);
+ /* Retire the APBH chain before its buffers are unmapped. */
+ dmaengine_terminate_sync(get_dma_chan(this));
ret = -ETIMEDOUT;
goto unmap;
}
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
@ 2026-10-30 14:39 ` Samarth Narang
0 siblings, 0 replies; 6+ messages in thread
From: Samarth Narang @ 2026-10-30 14:39 UTC (permalink / raw)
To: Han Xu, Miquel Raynal, Vignesh Raghavendra
Cc: Richard Weinberger, imx, linux-mtd, linux-kernel, Samarth Narang
When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
the operation's buffers and returns -ETIMEDOUT without stopping the APBH
DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
pending descriptor chain may resume after the timeout, while a
subsequent operation can append new descriptors to the stale chain and
cause the old DATA_IN transfer to execute again against an unmapped
buffer.
This can result in DMA writes to memory that has already been released,
including buffers freed after ONFI parameter page detection in
nand_onfi_detect().
Terminate the channel with dmaengine_terminate_sync() before unmapping
so that outstanding transfers are stopped and subsequent operations
begin with a fresh descriptor chain.
Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
Assisted-by: LLM
Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
---
This issue was identified by a research static analyzer for DMA
lifecycle ordering and has not been validated on hardware.
Compile-tested only.
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 527165ccc..a8106de2c 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
if (!to) {
dev_err(this->dev, "DMA timeout, last DMA\n");
gpmi_dump_info(this);
+ /* Retire the APBH chain before its buffers are unmapped. */
+ dmaengine_terminate_sync(get_dma_chan(this));
ret = -ETIMEDOUT;
goto unmap;
}
base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
2026-10-30 14:39 ` Samarth Narang
@ 2026-10-30 14:56 ` Frank Li
-1 siblings, 0 replies; 6+ messages in thread
From: Frank Li @ 2026-10-30 14:56 UTC (permalink / raw)
To: Samarth Narang
Cc: Han Xu, Miquel Raynal, Vignesh Raghavendra, Richard Weinberger,
imx, linux-mtd, linux-kernel
On Fri, Oct 30, 2026 at 02:39:45PM +0000, Samarth Narang wrote:
> [You don't often get email from samarth.colleges@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
> the operation's buffers and returns -ETIMEDOUT without stopping the APBH
> DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
> pending descriptor chain may resume after the timeout, while a
> subsequent operation can append new descriptors to the stale chain and
> cause the old DATA_IN transfer to execute again against an unmapped
> buffer.
>
> This can result in DMA writes to memory that has already been released,
> including buffers freed after ONFI parameter page detection in
> nand_onfi_detect().
>
> Terminate the channel with dmaengine_terminate_sync() before unmapping
> so that outstanding transfers are stopped and subsequent operations
> begin with a fresh descriptor chain.
>
> Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
> Assisted-by: LLM
> Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> This issue was identified by a research static analyzer for DMA
> lifecycle ordering and has not been validated on hardware.
> Compile-tested only.
>
> drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
> if (!to) {
> dev_err(this->dev, "DMA timeout, last DMA\n");
> gpmi_dump_info(this);
> + /* Retire the APBH chain before its buffers are unmapped. */
> + dmaengine_terminate_sync(get_dma_chan(this));
> ret = -ETIMEDOUT;
> goto unmap;
> }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
@ 2026-10-30 14:56 ` Frank Li
0 siblings, 0 replies; 6+ messages in thread
From: Frank Li @ 2026-10-30 14:56 UTC (permalink / raw)
To: Samarth Narang
Cc: Han Xu, Miquel Raynal, Vignesh Raghavendra, Richard Weinberger,
imx, linux-mtd, linux-kernel
On Fri, Oct 30, 2026 at 02:39:45PM +0000, Samarth Narang wrote:
> [You don't often get email from samarth.colleges@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
> the operation's buffers and returns -ETIMEDOUT without stopping the APBH
> DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
> pending descriptor chain may resume after the timeout, while a
> subsequent operation can append new descriptors to the stale chain and
> cause the old DATA_IN transfer to execute again against an unmapped
> buffer.
>
> This can result in DMA writes to memory that has already been released,
> including buffers freed after ONFI parameter page detection in
> nand_onfi_detect().
>
> Terminate the channel with dmaengine_terminate_sync() before unmapping
> so that outstanding transfers are stopped and subsequent operations
> begin with a fresh descriptor chain.
>
> Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
> Assisted-by: LLM
> Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> This issue was identified by a research static analyzer for DMA
> lifecycle ordering and has not been validated on hardware.
> Compile-tested only.
>
> drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
> if (!to) {
> dev_err(this->dev, "DMA timeout, last DMA\n");
> gpmi_dump_info(this);
> + /* Retire the APBH chain before its buffers are unmapped. */
> + dmaengine_terminate_sync(get_dma_chan(this));
> ret = -ETIMEDOUT;
> goto unmap;
> }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
>
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
2026-10-30 14:39 ` Samarth Narang
@ 2026-10-30 15:00 ` Miquel Raynal
-1 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2026-10-30 15:00 UTC (permalink / raw)
To: Samarth Narang
Cc: Han Xu, Vignesh Raghavendra, Richard Weinberger, imx, linux-mtd,
linux-kernel
Hello,
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
> if (!to) {
> dev_err(this->dev, "DMA timeout, last DMA\n");
> gpmi_dump_info(this);
> + /* Retire the APBH chain before its buffers are unmapped. */
Please drop this comment.
Otherwise fine.
> + dmaengine_terminate_sync(get_dma_chan(this));
> ret = -ETIMEDOUT;
> goto unmap;
> }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
Thanks,
Miquèl
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout
@ 2026-10-30 15:00 ` Miquel Raynal
0 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2026-10-30 15:00 UTC (permalink / raw)
To: Samarth Narang
Cc: Han Xu, Vignesh Raghavendra, Richard Weinberger, imx, linux-mtd,
linux-kernel
Hello,
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
> if (!to) {
> dev_err(this->dev, "DMA timeout, last DMA\n");
> gpmi_dump_info(this);
> + /* Retire the APBH chain before its buffers are unmapped. */
Please drop this comment.
Otherwise fine.
> + dmaengine_terminate_sync(get_dma_chan(this));
> ret = -ETIMEDOUT;
> goto unmap;
> }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
Thanks,
Miquèl
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-30 15:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-30 14:39 [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout Samarth Narang
2026-10-30 14:39 ` Samarth Narang
2026-10-30 14:56 ` Frank Li
2026-10-30 14:56 ` Frank Li
2026-10-30 15:00 ` Miquel Raynal
2026-10-30 15:00 ` Miquel Raynal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.