Re: [PATCH v6 05/14] dmaengine: dw-edma: Add partial channel ownership mode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Teardown asymmetry / UAF risk in dw_edma_remove
--

--- Patch [5]: [PATCH v6 05/14] dmaengine: dw-edma: Add partial channel ownership mode ---
commit 4c8696aea18fd0130d8ca7adb9a53eadf014e468
Author: Koichiro Den <den@valinux.co.jp>

dmaengine: dw-edma: Add partial channel ownership mode

This commit adds a partial ownership flag for DesignWare eDMA instances
representing a subset of channels. It modifies initialization and teardown
to use a limited quiesce path instead of full core resets, preserving
controller-wide state owned by the peer.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index ee9a8c32adf4c..c9df5bbe23925 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c

[ ... ]

> @@ -1213,14 +1268,16 @@ int dw_edma_remove(struct dw_edma_chip *chip)
>  	struct dw_edma_chan *chan, *_chan;
>  	struct device *dev = chip->dev;
>  	struct dw_edma *dw = chip->dw;
> -	int i;
> +	int i, err = 0;
>  
>  	/* Skip removal if no private data found */
>  	if (!dw)
>  		return -ENODEV;
>  
> -	/* Disable eDMA */
> -	dw_edma_core_off(dw);
> +	if (chip->flags & DW_EDMA_CHIP_PARTIAL)
> +		err = dw_edma_core_quiesce(dw);
> +	else
> +		dw_edma_core_off(dw);

[Severity: High]
This is a pre-existing issue, but does the teardown sequence in
dw_edma_remove() risk a use-after-free during device unbind?

Looking at dw_edma_remove() in drivers/dma/dw-edma/dw-edma-core.c, the core is
disabled here, IRQs are freed, and the workqueue is destroyed via
destroy_workqueue(dw->wq). Only after these steps are completed is the device
unregistered from the DMA subsystem via dma_async_device_unregister(&dw->dma).

Since the device is still exposed to the DMA engine subsystem during this
window, could a client request a channel or submit a new DMA transfer, causing
the driver to queue operations on the already destroyed workqueue or program
disabled hardware?

>  	/* Free irqs */
>  	for (i = (dw->nr_irqs - 1); i >= 0; i--)

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721062815.4117887-1-den@valinux.co.jp?part=5