Re: [PATCH v3 06/24] dmaengine: dw-edma: Dispatch DONE interrupts by channel request

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The DMA subsystem is unregistered after the hardware is turned off, interrupts are freed, and the workqueue is destroyed, allowing active clients to access freed or stopped resources.
--

--- Patch [6]: [PATCH v3 06/24] dmaengine: dw-edma: Dispatch DONE interrupts by channel request ---
commit 9cc3e80742a029b2761081307fe945a794ab8be6
Author: Koichiro Den <den@valinux.co.jp>

dmaengine: dw-edma: Dispatch DONE interrupts by channel request

This commit prepares for LL progress reclamation by moving the request
switch outside the descriptor check. It separates this non-functional
reordering from progress accounting, ensuring STOP and PAUSE states
update correctly even when no descriptor remains.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index 6e7d1f7c20f93..b419ff2becf9e 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for a client
to access freed or stopped resources during driver unbind?

Looking at dw_edma_remove(), the DMA subsystem is unregistered after the
hardware is turned off, interrupts are freed, and the workqueue is
destroyed:

drivers/dma/dw-edma/dw-edma-core.c:dw_edma_remove() {
	...
	if (chip->flags & DW_EDMA_CHIP_PARTIAL)
		err = dw_edma_core_quiesce(dw);
	else
		dw_edma_core_off(dw);

	for (i = (dw->nr_irqs - 1); i >= 0; i--)
		free_irq(chip->ops->irq_vector(dev, i), &dw->irq[i]);
	dw_edma_emul_irq_free(dw);
	...
	destroy_workqueue(dw->wq);

	/* Deregister eDMA device */
	dma_async_device_unregister(&dw->dma);
	...
}

If a user unbinds the DMA driver via sysfs or a PCI hot-remove occurs,
could a concurrent client attempt to issue a DMA request because the
device is still globally registered with the DMA engine subsystem?

Should dma_async_device_unregister() be called at the beginning of
dw_edma_remove() to prevent new subsystem interactions and avoid a
potential system crash like a PCIe UR fault or use-after-free on the
workqueue?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727170323.2321369-1-den@valinux.co.jp?part=6