[PATCH 0/6] plx_dma fixes

[PATCH 0/6] plx_dma fixes

[Logan Gunthorpe]

I got out my old PLX hardware to cleanup the issues that Sashiko reported
after I submitted another fix earlier this year. While testing, I also hit
a sleeping BUG that trigger when unbinding the driver which is fixed
in the first patch.

I think every patch is easily understood and independent.

This series is based off of v7.4rc1.

Thanks,

Logan

Logan Gunthorpe (6):
  dmaengine: plx_dma: don't call pci_irq_vector() under rcu_read_lock()
  dmaengine: plx_dma: fix descriptor ring leak in alloc_chan_resources()
  dmaengine: plx_dma: use writel() for the 32-bit PLX_REG_CTRL register
  dmaengine: plx_dma: add dma_rmb() after observing write-back status
  dmaengine: plx_dma: use spin_lock_bh() in plx_dma_process_desc()
  dmaengine: plx_dma: don't invoke client callbacks with ring_lock held

 drivers/dma/plx_dma.c | 64 +++++++++++++++++++++++++++++--------------
 1 file changed, 43 insertions(+), 21 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.47.3

[PATCH 1/6] dmaengine: plx_dma: don't call pci_irq_vector() under rcu_read_lock()

[Logan Gunthorpe]

plx_dma_free_chan_resources() calls pci_irq_vector() inside an RCU
read-side section, but msi_domain_get_virq() takes the mutex that
protects the device's MSI descriptors. Releasing a channel, for example
at the end of a dmatest run, triggers:

  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:623
  ...
  RCU nest depth: 1, expected: 0
  Call Trace:
   __mutex_lock+0x113/0x2350
   msi_domain_get_virq+0x227/0x2f0
   pci_irq_vector+0x9a/0xc0
   plx_dma_free_chan_resources+0x178/0x58f [plx_dma]
   dma_chan_put+0x157/0x380
   dma_release_channel+0xac/0x2e0

Store the IRQ number at probe time and use it everywhere
pci_irq_vector() was called, so the teardown path no longer needs to
look it up.

Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization and cleanup")
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index 409898e92c32..0a7ad2473cb1 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -104,6 +104,7 @@ struct plx_dma_dev {
 	struct dma_device dma_dev;
 	struct dma_chan dma_chan;
 	struct pci_dev __rcu *pdev;
+	int irq;
 	void __iomem *bar;
 	struct tasklet_struct desc_task;
 
@@ -452,7 +453,6 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
 {
 	struct plx_dma_dev *plxdev = chan_to_plx_dma_dev(chan);
 	size_t ring_sz = PLX_DMA_RING_COUNT * sizeof(*plxdev->hw_ring);
-	struct pci_dev *pdev;
 	int irq = -1;
 	int i;
 
@@ -463,9 +463,8 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
 	plx_dma_stop(plxdev);
 
 	rcu_read_lock();
-	pdev = rcu_dereference(plxdev->pdev);
-	if (pdev)
-		irq = pci_irq_vector(pdev, 0);
+	if (rcu_dereference(plxdev->pdev))
+		irq = plxdev->irq;
 	rcu_read_unlock();
 
 	if (irq > 0)
@@ -510,8 +509,9 @@ static int plx_dma_create(struct pci_dev *pdev)
 	RCU_INIT_POINTER(plxdev->pdev, pdev);
 	plxdev->bar = pcim_iomap_table(pdev)[0];
 
-	rc = request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0,
-			 KBUILD_MODNAME, plxdev);
+	plxdev->irq = pci_irq_vector(pdev, 0);
+
+	rc = request_irq(plxdev->irq, plx_dma_isr, 0, KBUILD_MODNAME, plxdev);
 	if (rc)
 		goto free_plx;
 
@@ -545,7 +545,7 @@ static int plx_dma_create(struct pci_dev *pdev)
 
 put_device:
 	put_device(&pdev->dev);
-	free_irq(pci_irq_vector(pdev, 0),  plxdev);
+	free_irq(plxdev->irq, plxdev);
 free_plx:
 	kfree(plxdev);
 
@@ -594,7 +594,7 @@ static void plx_dma_remove(struct pci_dev *pdev)
 {
 	struct plx_dma_dev *plxdev = pci_get_drvdata(pdev);
 
-	free_irq(pci_irq_vector(pdev, 0),  plxdev);
+	free_irq(plxdev->irq, plxdev);
 
 	rcu_assign_pointer(plxdev->pdev, NULL);
 	synchronize_rcu();
-- 
2.47.3

[PATCH 2/6] dmaengine: plx_dma: fix descriptor ring leak in alloc_chan_resources()

[Logan Gunthorpe]

If the device is removed between plx_dma_alloc_desc() and the pdev
check, the error path frees hw_ring but leaks desc_ring and every
descriptor in it.

Add plx_dma_free_desc() and use it here and in
plx_dma_free_chan_resources().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index 0a7ad2473cb1..bfccbb0c70e8 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -404,6 +404,16 @@ static int plx_dma_alloc_desc(struct plx_dma_dev *plxdev)
 	return -ENOMEM;
 }
 
+static void plx_dma_free_desc(struct plx_dma_dev *plxdev)
+{
+	int i;
+
+	for (i = 0; i < PLX_DMA_RING_COUNT; i++)
+		kfree(plxdev->desc_ring[i]);
+
+	kfree(plxdev->desc_ring);
+}
+
 static int plx_dma_alloc_chan_resources(struct dma_chan *chan)
 {
 	struct plx_dma_dev *plxdev = chan_to_plx_dma_dev(chan);
@@ -424,7 +434,7 @@ static int plx_dma_alloc_chan_resources(struct dma_chan *chan)
 	if (!rcu_dereference(plxdev->pdev)) {
 		rcu_read_unlock();
 		rc = -ENODEV;
-		goto out_free_hw_ring;
+		goto out_free_desc;
 	}
 
 	writel(PLX_REG_CTRL_RESET_VAL, plxdev->bar + PLX_REG_CTRL);
@@ -443,6 +453,8 @@ static int plx_dma_alloc_chan_resources(struct dma_chan *chan)
 
 	return PLX_DMA_RING_COUNT;
 
+out_free_desc:
+	plx_dma_free_desc(plxdev);
 out_free_hw_ring:
 	dma_free_coherent(plxdev->dma_dev.dev, ring_sz, plxdev->hw_ring,
 			  plxdev->hw_ring_dma);
@@ -454,7 +466,6 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
 	struct plx_dma_dev *plxdev = chan_to_plx_dma_dev(chan);
 	size_t ring_sz = PLX_DMA_RING_COUNT * sizeof(*plxdev->hw_ring);
 	int irq = -1;
-	int i;
 
 	spin_lock_bh(&plxdev->ring_lock);
 	plxdev->ring_active = false;
@@ -474,10 +485,7 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
 
 	plx_dma_abort_desc(plxdev);
 
-	for (i = 0; i < PLX_DMA_RING_COUNT; i++)
-		kfree(plxdev->desc_ring[i]);
-
-	kfree(plxdev->desc_ring);
+	plx_dma_free_desc(plxdev);
 	dma_free_coherent(plxdev->dma_dev.dev, ring_sz, plxdev->hw_ring,
 			  plxdev->hw_ring_dma);
 
-- 
2.47.3

[PATCH 3/6] dmaengine: plx_dma: use writel() for the 32-bit PLX_REG_CTRL register

[Logan Gunthorpe]

plx_dma_issue_pending() writes PLX_REG_CTRL with writew(), but it is a
32-bit register and every other access uses writel()/readl().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index bfccbb0c70e8..1c995f0c4463 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -351,7 +351,7 @@ static void plx_dma_issue_pending(struct dma_chan *chan)
 	 */
 	wmb();
 
-	writew(PLX_REG_CTRL_START_VAL, plxdev->bar + PLX_REG_CTRL);
+	writel(PLX_REG_CTRL_START_VAL, plxdev->bar + PLX_REG_CTRL);
 
 	rcu_read_unlock();
 }
-- 
2.47.3

[PATCH 4/6] dmaengine: plx_dma: add dma_rmb() after observing write-back status

[Logan Gunthorpe]

Add a dma_rmb() after the write-back status check so reads of the
transferred data can't be satisfied before the read that showed the
transfer was complete.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index 1c995f0c4463..e4243b66f933 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -148,6 +148,12 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 		if (flags & PLX_DESC_FLAG_VALID)
 			break;
 
+		/*
+		 * Ensure the write-back status is read before the
+		 * completed transfer's payload.
+		 */
+		dma_rmb();
+
 		res.residue = desc->orig_size - (flags & PLX_DESC_SIZE_MASK);
 
 		if (flags & PLX_DESC_WB_SUCCESS)
-- 
2.47.3

[PATCH 5/6] dmaengine: plx_dma: use spin_lock_bh() in plx_dma_process_desc()

[Logan Gunthorpe]

plx_dma_process_desc() is also called from plx_dma_tx_status() in
process context. With a plain spin_lock(), the desc_task tasklet can
run on the same CPU while the lock is held, and spin on it forever.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index e4243b66f933..8c4b19d681ad 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -138,7 +138,7 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 	struct plx_dma_desc *desc;
 	u32 flags;
 
-	spin_lock(&plxdev->ring_lock);
+	spin_lock_bh(&plxdev->ring_lock);
 
 	while (plxdev->tail != plxdev->head) {
 		desc = plx_dma_get_desc(plxdev, plxdev->tail);
@@ -172,7 +172,7 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 		plxdev->tail++;
 	}
 
-	spin_unlock(&plxdev->ring_lock);
+	spin_unlock_bh(&plxdev->ring_lock);
 }
 
 static void plx_dma_abort_desc(struct plx_dma_dev *plxdev)
-- 
2.47.3

[PATCH 6/6] dmaengine: plx_dma: don't invoke client callbacks with ring_lock held

[Logan Gunthorpe]

plx_dma_process_desc() and plx_dma_abort_desc() invoke the client's
completion callback with ring_lock held. A callback that submits a new
transfer, which is common, deadlocks taking the same lock in
plx_dma_prep_memcpy().

Copy and clear the callback and advance tail under the lock, then drop
the lock to invoke it.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
---
 drivers/dma/plx_dma.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
index 8c4b19d681ad..17745f7a5658 100644
--- a/drivers/dma/plx_dma.c
+++ b/drivers/dma/plx_dma.c
@@ -134,6 +134,7 @@ static struct plx_dma_desc *plx_dma_get_desc(struct plx_dma_dev *plxdev, int i)
 
 static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 {
+	struct dmaengine_desc_callback cb;
 	struct dmaengine_result res;
 	struct plx_dma_desc *desc;
 	u32 flags;
@@ -165,11 +166,14 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 
 		dma_cookie_complete(&desc->txd);
 		dma_descriptor_unmap(&desc->txd);
-		dmaengine_desc_get_callback_invoke(&desc->txd, &res);
+		dmaengine_desc_get_callback(&desc->txd, &cb);
 		desc->txd.callback = NULL;
 		desc->txd.callback_result = NULL;
-
 		plxdev->tail++;
+
+		spin_unlock_bh(&plxdev->ring_lock);
+		dmaengine_desc_callback_invoke(&cb, &res);
+		spin_lock_bh(&plxdev->ring_lock);
 	}
 
 	spin_unlock_bh(&plxdev->ring_lock);
@@ -177,6 +181,7 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
 
 static void plx_dma_abort_desc(struct plx_dma_dev *plxdev)
 {
+	struct dmaengine_desc_callback cb;
 	struct dmaengine_result res;
 	struct plx_dma_desc *desc;
 
@@ -192,11 +197,14 @@ static void plx_dma_abort_desc(struct plx_dma_dev *plxdev)
 
 		dma_cookie_complete(&desc->txd);
 		dma_descriptor_unmap(&desc->txd);
-		dmaengine_desc_get_callback_invoke(&desc->txd, &res);
+		dmaengine_desc_get_callback(&desc->txd, &cb);
 		desc->txd.callback = NULL;
 		desc->txd.callback_result = NULL;
-
 		plxdev->tail++;
+
+		spin_unlock_bh(&plxdev->ring_lock);
+		dmaengine_desc_callback_invoke(&cb, &res);
+		spin_lock_bh(&plxdev->ring_lock);
 	}
 
 	spin_unlock_bh(&plxdev->ring_lock);
-- 
2.47.3

Re: [PATCH 6/6] dmaengine: plx_dma: don't invoke client callbacks with ring_lock held

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] dmaengine: plx_dma: premature teardown in plx_dma_free_chan_resources()
- [Medium] dmaengine: plx_dma: race in plx_dma_process_desc() when dropping ring_lock
--

commit 3bb7031cbf95b71426caf9709207e0ede88301d6
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: plx_dma: don't invoke client callbacks with ring_lock held

This commit updates plx_dma_process_desc() and plx_dma_abort_desc() to copy
and clear descriptor completion callbacks, advance plxdev->tail, and drop
plxdev->ring_lock before invoking the callback to avoid a deadlock when a
callback prepares a new transfer.

Link: https://lore.kernel.org/dmaengine/20260717223217.B6FBF1F000E9@smtp.kernel.org

> diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
> index 8c4b19d681ad5..17745f7a5658d 100644
> --- a/drivers/dma/plx_dma.c
> +++ b/drivers/dma/plx_dma.c
> @@ -134,6 +134,7 @@ static struct plx_dma_desc *plx_dma_get_desc(struct plx_dma_dev *plxdev, int i)
>  
>  static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
>  {
> +	struct dmaengine_desc_callback cb;
>  	struct dmaengine_result res;
>  	struct plx_dma_desc *desc;
>  	u32 flags;
> @@ -165,11 +166,14 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
>  
>  		dma_cookie_complete(&desc->txd);
>  		dma_descriptor_unmap(&desc->txd);
> -		dmaengine_desc_get_callback_invoke(&desc->txd, &res);
> +		dmaengine_desc_get_callback(&desc->txd, &cb);
>  		desc->txd.callback = NULL;
>  		desc->txd.callback_result = NULL;
> -
>  		plxdev->tail++;
> +
> +		spin_unlock_bh(&plxdev->ring_lock);
> +		dmaengine_desc_callback_invoke(&cb, &res);
> +		spin_lock_bh(&plxdev->ring_lock);

[Severity: Medium]
Can dropping plxdev->ring_lock here after calling dma_cookie_complete() and
incrementing plxdev->tail cause descriptor callbacks to run out of order or
concurrently?

plx_dma_process_desc() is called both from the tasklet plx_dma_desc_task()
and from plx_dma_tx_status():

drivers/dma/plx_dma.c:plx_dma_tx_status() {
	ret = dma_cookie_status(chan, cookie, txstate);
	if (ret == DMA_COMPLETE)
		return ret;

	plx_dma_process_desc(plxdev);

	return dma_cookie_status(chan, cookie, txstate);
}

When plx_dma_tx_status() calls plx_dma_process_desc() in process context and
an interrupt schedules plxdev->desc_task while bottom halves are disabled
under spin_lock_bh(), calling spin_unlock_bh(&plxdev->ring_lock) re-enables
bottom halves and can immediately run plx_dma_desc_task() ->
plx_dma_process_desc() on the same CPU before dmaengine_desc_callback_invoke()
is called for the first descriptor. Because plxdev->tail was already
incremented, the tasklet will process subsequent descriptors and invoke
their callbacks ahead of the earlier descriptor's callback.

Similarly, on SMP, while one caller has dropped plxdev->ring_lock to execute
dmaengine_desc_callback_invoke(), a concurrent caller of plx_dma_tx_status()
on another CPU can enter plx_dma_process_desc(), observe the updated
plxdev->tail, and invoke subsequent callbacks concurrently, or observe
DMA_COMPLETE from dma_cookie_status() while the descriptor's callback is
still running.

>  	}
>  
>  	spin_unlock_bh(&plxdev->ring_lock);
> @@ -177,6 +181,7 @@ static void plx_dma_process_desc(struct plx_dma_dev *plxdev)
>  
>  static void plx_dma_abort_desc(struct plx_dma_dev *plxdev)
>  {
> +	struct dmaengine_desc_callback cb;
>  	struct dmaengine_result res;
>  	struct plx_dma_desc *desc;
>  
> @@ -192,11 +197,14 @@ static void plx_dma_abort_desc(struct plx_dma_dev *plxdev)
>  
>  		dma_cookie_complete(&desc->txd);
>  		dma_descriptor_unmap(&desc->txd);
> -		dmaengine_desc_get_callback_invoke(&desc->txd, &res);
> +		dmaengine_desc_get_callback(&desc->txd, &cb);
>  		desc->txd.callback = NULL;
>  		desc->txd.callback_result = NULL;
> -
>  		plxdev->tail++;
> +
> +		spin_unlock_bh(&plxdev->ring_lock);
> +		dmaengine_desc_callback_invoke(&cb, &res);
> +		spin_lock_bh(&plxdev->ring_lock);

[Severity: High]
Does releasing plxdev->ring_lock after advancing plxdev->tail in
plx_dma_process_desc() and plx_dma_abort_desc() allow
plx_dma_free_chan_resources() to finish tearing down the channel while a
callback is still executing on another CPU?

Previously, holding plxdev->ring_lock across the entire loop ensured that
plx_dma_abort_desc() in plx_dma_free_chan_resources() would wait until any
concurrent plx_dma_process_desc() or plx_dma_abort_desc() call finished
invoking all callbacks.

With plxdev->ring_lock dropped around dmaengine_desc_callback_invoke(), if
CPU0 is in plx_dma_remove() -> plx_dma_abort_desc() or plx_dma_tx_status() ->
plx_dma_process_desc() and advances plxdev->tail to plxdev->head before
dropping plxdev->ring_lock, CPU1 can run dma_release_channel() ->
plx_dma_free_chan_resources():

drivers/dma/plx_dma.c:plx_dma_free_chan_resources() {
	...
	tasklet_kill(&plxdev->desc_task);

	plx_dma_abort_desc(plxdev);

	plx_dma_free_desc(plxdev);
	dma_free_coherent(plxdev->dma_dev.dev, ring_sz, plxdev->hw_ring,
			  plxdev->hw_ring_dma);
}

Because tasklet_kill() only waits for plxdev->desc_task, plx_dma_abort_desc()
on CPU1 can acquire plxdev->ring_lock, see plxdev->tail == plxdev->head, and
return immediately while CPU0 is still inside dmaengine_desc_callback_invoke().
plx_dma_free_chan_resources() and dma_release_channel() will then return and
allow the client (such as ntb_transport_free_queue() or ntb_perf) to free the
callback parameter data while the callback is still using it on CPU0.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103155202.461725-1-logang@deltatee.com?part=6

Re: [PATCH 6/6] dmaengine: plx_dma: don't invoke client callbacks with ring_lock held

[Logan Gunthorpe]

On 2026-11-03 09:13, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] dmaengine: plx_dma: premature teardown in plx_dma_free_chan_resources()
> - [Medium] dmaengine: plx_dma: race in plx_dma_process_desc() when dropping ring_lock

I've queued up a fix that I think will address both these issues.

I'll send a v2 series with the change and any other feedback in a week
or two.

Logan