[PATCH v2 0/4] dmaengine: dma-axi-dmac: Some memory related fixes

Nuno Sá via B4 Relay
2026-03-27T16:57:52Z

Ok, I rushed into v2 because I saw (based on AI review) that I already
had some fundamental issues. Some fairly straight (a bit embarrassing tbh)
but others not so much. Another thing to notice is that I changed the
order between "fix use-after-free on unbind" and "Defer freeing DMA
descriptors" because it just makes more sense given that using the
worker only works 100% if we don't have our DMA object bounded with the
platform driver.

Anyways, more details on the changelog.

Also note the addition of two new patches. The dmaengine one seems legit
but I want to note it was just by code inspection.

Signed-off-by: Nuno Sá <nuno.sa@analog.com>
---
Changes in v2:
- Patch 1:
* New patch.
- Patch 2:
* New patch.
- Patch 3:
* Use __free() to allocate the ojject so we don't leak in early
errors. Note that after dmaenginem_async_device_register(), the
object lifetime is handled by dmaengine;
* Move get_device() to after registering the device;
* Still allow to free DMA descriptors in axi_dmac_terminate_all();
* Use spin_lock_irqsave() to avoid possible deadlocks.
* Include spinlock.h
- Patch 4:
* Include workqueue.h;
* Save struct device directly in struct axi_dmac_desc and get a
reference when allocating. Give the reference when freeing the
descriptor.
- Link to v1: https://patch.msgid.link/20260326-dma-dmac-handle-vunmap-v1-0-be3e46ffaf69@analog.com

---
Eliza Balas (1):
dmaengine: dma-axi-dmac: Defer freeing DMA descriptors

Nuno Sá (3):
dmaengine: Fix possuible use after free
dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
dmaengine: dma-axi-dmac: fix use-after-free on unbind

drivers/dma/dma-axi-dmac.c | 122 ++++++++++++++++++++++++++++++++++++---------
drivers/dma/dmaengine.c | 3 +-
2 files changed, 100 insertions(+), 25 deletions(-)
---
base-commit: b7560798466a07d9c3fb011698e92c335ab28baf
change-id: 20260325-dma-dmac-handle-vunmap-84a06df7d133
--

Thanks!
- Nuno Sá