Re: [PATCH v2 50/64] dmaengine: dw-edma: kill vchan BH on teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Virtual DMA descriptors are leaked during channel teardown and release due to missing vchan_free_chan_resources(), leading to memory leaks and critical use-after-free memory corruption on channel reuse.
--

--- Patch [50]: [PATCH v2 50/64] dmaengine: dw-edma: kill vchan BH on teardown ---
commit 5cb424de4644af7e57a2169fe1e94e001c0d3927
Author: Allen Pais <allen.lkml@gmail.com>

dmaengine: dw-edma: kill vchan BH on teardown

This commit modifies the dw-edma driver to use dma_chan_kill_bh() for
cleaning up virt-dma channels during teardown, replacing the older
tasklet_kill() usage.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index 89a4c498a17b8..a47a4674df838 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
> @@ -1170,7 +1170,7 @@ int dw_edma_remove(struct dw_edma_chip *chip)
>  	dma_async_device_unregister(&dw->dma);
>  	list_for_each_entry_safe(chan, _chan, &dw->dma.channels,
>  				 vc.chan.device_node) {
> -		tasklet_kill(&chan->vc.task);
> +		dma_chan_kill_bh(&chan->vc.chan);

[Severity: Critical]
This is a pre-existing issue, but does this teardown sequence leak virtual
DMA descriptors because it misses a call to vchan_free_chan_resources()?

If a client queues a DMA transfer, aborts it via
dw_edma_device_terminate_all(), and releases the channel, the aborted
descriptors are not removed from the virt-dma queues because
dw_edma_free_chan_resources() also lacks a call to
vchan_free_chan_resources() to clear the pending lists.

When the channel is requested again and started, could
dw_edma_start_transfer() mistakenly pull a stale descriptor from
vchan_next_desc(), leading to memory corruption and a use-after-free?

>  		list_del(&chan->vc.chan.device_node);
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785183549.git.allen.lkml@gmail.com?part=50