[PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout

[PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout

[Samarth Narang]

When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
the operation's buffers and returns -ETIMEDOUT without stopping the APBH
DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
pending descriptor chain may resume after the timeout, while a
subsequent operation can append new descriptors to the stale chain and
cause the old DATA_IN transfer to execute again against an unmapped
buffer.

This can result in DMA writes to memory that has already been released,
including buffers freed after ONFI parameter page detection in
nand_onfi_detect().

Terminate the channel with dmaengine_terminate_sync() before unmapping
so that outstanding transfers are stopped and subsequent operations
begin with a fresh descriptor chain.

Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
Assisted-by: LLM
Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
---
This issue was identified by a research static analyzer for DMA
lifecycle ordering and has not been validated on hardware.
Compile-tested only.

 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 527165ccc..a8106de2c 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
 	if (!to) {
 		dev_err(this->dev, "DMA timeout, last DMA\n");
 		gpmi_dump_info(this);
+		/* Retire the APBH chain before its buffers are unmapped. */
+		dmaengine_terminate_sync(get_dma_chan(this));
 		ret = -ETIMEDOUT;
 		goto unmap;
 	}

base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907

Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout

[Frank Li]

On Fri, Oct 30, 2026 at 02:39:45PM +0000, Samarth Narang wrote:
> [You don't often get email from samarth.colleges@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> When DMA completion times out in gpmi_nfc_exec_op(), the driver unmaps
> the operation's buffers and returns -ETIMEDOUT without stopping the APBH
> DMA channel. Since mxs-dma leaves the channel in DMA_IN_PROGRESS, the
> pending descriptor chain may resume after the timeout, while a
> subsequent operation can append new descriptors to the stale chain and
> cause the old DATA_IN transfer to execute again against an unmapped
> buffer.
>
> This can result in DMA writes to memory that has already been released,
> including buffers freed after ONFI parameter page detection in
> nand_onfi_detect().
>
> Terminate the channel with dmaengine_terminate_sync() before unmapping
> so that outstanding transfers are stopped and subsequent operations
> begin with a fresh descriptor chain.
>
> Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op")
> Assisted-by: LLM
> Signed-off-by: Samarth Narang <samarth.colleges@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> This issue was identified by a research static analyzer for DMA
> lifecycle ordering and has not been validated on hardware.
> Compile-tested only.
>
>  drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c |    2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
>         if (!to) {
>                 dev_err(this->dev, "DMA timeout, last DMA\n");
>                 gpmi_dump_info(this);
> +               /* Retire the APBH chain before its buffers are unmapped. */
> +               dmaengine_terminate_sync(get_dma_chan(this));
>                 ret = -ETIMEDOUT;
>                 goto unmap;
>         }
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907
>

Re: [PATCH] mtd: rawnand: gpmi: terminate the DMA chain on completion timeout

[Miquel Raynal]

Hello,

> diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> index 527165ccc..a8106de2c 100644
> --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
> @@ -2659,6 +2659,8 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip,
>  	if (!to) {
>  		dev_err(this->dev, "DMA timeout, last DMA\n");
>  		gpmi_dump_info(this);
> +		/* Retire the APBH chain before its buffers are unmapped. */

Please drop this comment.

Otherwise fine.

> +		dmaengine_terminate_sync(get_dma_chan(this));
>  		ret = -ETIMEDOUT;
>  		goto unmap;
>  	}
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907

Thanks,
Miquèl