Re: [PATCH v3 05/34] dmaengine: ep93xx: hook callbacks via dmaengine BH

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing dmaengine_kill_bh() causes use-after-free and premature callback invocation
--

--- Patch [5]: [PATCH v3 05/34] dmaengine: ep93xx: hook callbacks via dmaengine BH ---
commit 3ccb9d1bebba979771c31fb7e0c5d8c45b92dd9c
Author: Allen Pais <allen.lkml@gmail.com>
Date:   Mon Aug 10 18:09:06 2026 +0000

    dmaengine: ep93xx: hook callbacks via dmaengine BH
    
    Replace the per-channel tasklet with the shared dmaengine BH helper.
    The handler continues to run in softirq context while dmaengine owns
    the common scheduling and teardown mechanism.

> diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
> index a3395cfcf5dd5..b269d2f072f82 100644
> --- a/drivers/dma/ep93xx_dma.c
> +++ b/drivers/dma/ep93xx_dma.c

[ ... ]

> @@ -1421,7 +1419,7 @@ static struct ep93xx_dma_engine *ep93xx_dma_of_probe(struct platform_device *pde
>  		INIT_LIST_HEAD(&edmac->active);
>  		INIT_LIST_HEAD(&edmac->queue);
>  		INIT_LIST_HEAD(&edmac->free_list);
> -		tasklet_setup(&edmac->tasklet, ep93xx_dma_tasklet);
> +		dmaengine_init_bh(&edmac->chan, ep93xx_dma_tasklet);

[Severity: High]
This is a pre-existing issue, but should we be terminating the bottom-half
work during synchronization or resource cleanup?

If an interrupt fires and schedules the bottom-half work, but the client
calls dmaengine_terminate_all() and dma_release_channel() before the work
can execute, a new client could request the channel and submit a new
descriptor.

When the delayed bottom-half finally runs, could it access the new client's
descriptor from edmac->active and prematurely invoke its callback?

Also, if the driver is unbound via sysfs, devm_kzalloc frees the channel
memory. If the bottom-half is still scheduled, would this result in a
use-after-free?

It looks like we are missing a call to dmaengine_kill_bh() (and previously
tasklet_kill()) in ep93xx_dma_synchronize() or 
ep93xx_dma_free_chan_resources():

drivers/dma/ep93xx_dma.c:ep93xx_dma_synchronize() {
    ...
    if (edmac->edma->hw_synchronize)
        edmac->edma->hw_synchronize(edmac);
    ...
}

drivers/dma/ep93xx_dma.c:ep93xx_dma_free_chan_resources() {
    ...
    clk_disable_unprepare(edmac->clk);
    free_irq(edmac->irq, edmac);
    ...
}

>  
>  		list_add_tail(&edmac->chan.device_node,
>  			      &dma_dev->channels);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786384168.git.allen.lkml@gmail.com?part=5