Re: [PATCH v2] dmaengine: fsl-edma: tracing: no ptr dereference during log output

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Double byte-swapping of TCD register values on Big Endian CPUs.
--

--- Patch [1]: [PATCH v2] dmaengine: fsl-edma: tracing: no ptr dereference during log output ---
commit 3052808ada723a8fc5d5327178f31b6879486260
Author: Martin Kaiser <martin@kaiser.cx>
Date:   Sat Jul 18 12:58:48 2026 +0000

    dmaengine: fsl-edma: tracing: no ptr dereference during log output

    The fsl edma events store a pointer to a struct fsl_edma_engine in the
    ringbuffer and dereference it when a log entry is printed. This adds a
    membase field to the event to avoid dereferencing the pointer, preventing
    a use-after-free if the edma pointer becomes invalid.

    Fixes: 11102d0c343b ("dmaengine: fsl-edma: add trace event support")
    Cc: stable@vger.kernel.org

> diff --git a/drivers/dma/fsl-edma-trace.h b/drivers/dma/fsl-edma-trace.h
> index d3541301a2470..45d964a3726d6 100644
> --- a/drivers/dma/fsl-edma-trace.h
> +++ b/drivers/dma/fsl-edma-trace.h

[ ... ]

>  	TP_fast_assign(
>  		__entry->edma = edma;
>  		__entry->addr = addr;
>  		__entry->value = value;
> +		__entry->membase = edma->membase;
>  	),
>  	TP_printk("offset %08x: value %08x",
> -		(u32)(__entry->addr - __entry->edma->membase), __entry->value)
> +		(u32)(__entry->addr - __entry->membase), __entry->value)
>  );

[Severity: Critical]
This is a pre-existing issue, but I noticed a potential problem with how
the value being traced here is written to the hardware on Big Endian CPUs.

When a DMA transfer is initiated, fsl_edma_set_tcd_to_le() prepares the
in-memory descriptor fields in little-endian format. Then
edma_cp_tcd_to_reg() passes this little-endian value to edma_writel() via
edma_write_tcdreg_c():

drivers/dma/fsl-edma-common.h:edma_write_tcdreg_c() {
    ...
    __iomem __le32 : edma_writel(chan->edma, (u32 __force)(_val), ...
    ...
}

However, edma_writel() uses iowrite32() which assumes native CPU-endian
input:

drivers/dma/fsl-edma-common.h:edma_writel() {
    if (edma->big_endian)
        iowrite32be(val, addr);
    else
        iowrite32(val, addr);

    trace_edma_writel(edma, addr, val);
}

On Big Endian CPUs, does this result in iowrite32() double-swapping the
already little-endian descriptor data and writing a corrupted value to the
target and source addresses?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260718130024.341243-1-martin@kaiser.cx?part=1