* [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan
@ 2026-10-15 15:51 Frank.Li
2026-10-15 15:51 ` [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan * Frank.Li
2026-10-15 16:01 ` [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan sashiko-bot
0 siblings, 2 replies; 4+ messages in thread
From: Frank.Li @ 2026-10-15 15:51 UTC (permalink / raw)
To: Dan Williams, Herbert Xu, David S. Miller, Vinod Koul, Frank Li,
Jon Mason, Dave Jiang, Allen Hubbe, Ard Biesheuvel, Andrew Morton,
Eric Biggers, open list:CRYPTO API, open list,
open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM,
open list:NTB DRIVER CORE
Cc: imx, Frank Li
From: Frank Li <Frank.Li@nxp.com>
Replace the struct device *dev argument with struct dma_chan *chan so
callers do not need to reach into the dma_device internals to obtain
the device pointer. The implementation now derives the device via
dmaengine_get_dma_device(chan), which correctly handles the per-channel
IOMMU mapping case.
Prepare to make dma_device private and make dmaengine API consistent.
Acked-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
V4: none, just respin to miss patch2
V3 split from origianl thread
https://lore.kernel.org/dmaengine/20260923-dmaengine_prep_dma_pq-v2-0-32ed65b8a9b4@nxp.com/
V2 change collect Dave Jiang ack tags
v1 version at
https://lore.kernel.org/imx/b40fa0d7-fbd0-4ee8-b99c-781d08c18838@intel.com/T/#t
---
crypto/async_tx/async_memcpy.c | 4 ++--
crypto/async_tx/async_pq.c | 8 ++++----
crypto/async_tx/async_raid6_recov.c | 8 ++++----
crypto/async_tx/async_xor.c | 8 ++++----
drivers/dma/dmaengine.c | 4 ++--
drivers/dma/dmatest.c | 2 +-
drivers/dma/mv_xor.c | 4 ++--
drivers/ntb/ntb_transport.c | 4 ++--
drivers/ntb/test/ntb_perf.c | 2 +-
include/linux/dmaengine.h | 4 ++--
10 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/crypto/async_tx/async_memcpy.c b/crypto/async_tx/async_memcpy.c
index c538e30e99094..893e7e17f1f61 100644
--- a/crypto/async_tx/async_memcpy.c
+++ b/crypto/async_tx/async_memcpy.c
@@ -39,8 +39,8 @@ async_memcpy(struct page *dest, struct page *src, unsigned int dest_offset,
struct dma_async_tx_descriptor *tx = NULL;
struct dmaengine_unmap_data *unmap = NULL;
- if (device)
- unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, 2, GFP_NOWAIT);
if (unmap && is_dma_copy_aligned(device, src_offset, dest_offset, len)) {
unsigned long dma_prep_flags = 0;
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index 27f99349e310b..733af24a2762b 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -187,8 +187,8 @@ async_gen_syndrome(struct page **blocks, unsigned int *offsets, int disks,
BUG_ON(disks > MAX_DISKS || !(P(blocks, disks) || Q(blocks, disks)));
- if (device)
- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, disks, GFP_NOWAIT);
/* XORing P/Q is only implemented in software */
if (unmap && !(submit->flags & ASYNC_TX_PQ_XOR_DST) &&
@@ -309,8 +309,8 @@ async_syndrome_val(struct page **blocks, unsigned int *offsets, int disks,
BUG_ON(disks < 4 || disks > MAX_DISKS);
- if (device)
- unmap = dmaengine_get_unmap_data(device->dev, disks, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, disks, GFP_NOWAIT);
if (unmap && disks <= dma_maxpq(device, 0) &&
is_dma_pq_aligned_offs(device, offsets, disks, len)) {
diff --git a/crypto/async_tx/async_raid6_recov.c b/crypto/async_tx/async_raid6_recov.c
index e53870d84bc55..306448c47aa00 100644
--- a/crypto/async_tx/async_raid6_recov.c
+++ b/crypto/async_tx/async_raid6_recov.c
@@ -28,8 +28,8 @@ async_sum_product(struct page *dest, unsigned int d_off,
u8 ax, bx;
u8 *a, *b, *c;
- if (dma)
- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, 3, GFP_NOWAIT);
if (unmap) {
struct device *dev = dma->dev;
@@ -96,8 +96,8 @@ async_mult(struct page *dest, unsigned int d_off, struct page *src,
const u8 *qmul; /* Q multiplier table */
u8 *d, *s;
- if (dma)
- unmap = dmaengine_get_unmap_data(dma->dev, 3, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, 3, GFP_NOWAIT);
if (unmap) {
dma_addr_t dma_dest[2];
diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
index 84458375b202b..40caee262a4ab 100644
--- a/crypto/async_tx/async_xor.c
+++ b/crypto/async_tx/async_xor.c
@@ -178,8 +178,8 @@ async_xor_offs(struct page *dest, unsigned int offset,
BUG_ON(src_cnt <= 1);
- if (device)
- unmap = dmaengine_get_unmap_data(device->dev, src_cnt+1, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, src_cnt + 1, GFP_NOWAIT);
if (unmap && dma_xor_aligned_offsets(device, offset,
src_offs, src_cnt, len)) {
@@ -310,8 +310,8 @@ async_xor_val_offs(struct page *dest, unsigned int offset,
BUG_ON(src_cnt <= 1);
- if (device)
- unmap = dmaengine_get_unmap_data(device->dev, src_cnt, GFP_NOWAIT);
+ if (chan)
+ unmap = dmaengine_get_unmap_data(chan, src_cnt, GFP_NOWAIT);
if (unmap && src_cnt <= device->max_xor &&
dma_xor_aligned_offsets(device, offset, src_offs, src_cnt, len)) {
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 34be53487a21d..52e7dcc4e5822 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1477,7 +1477,7 @@ static int __init dmaengine_init_unmap_pool(void)
}
struct dmaengine_unmap_data *
-dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
+dmaengine_get_unmap_data(struct dma_chan *chan, int nr, gfp_t flags)
{
struct dmaengine_unmap_data *unmap;
@@ -1487,7 +1487,7 @@ dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
memset(unmap, 0, sizeof(*unmap));
kref_init(&unmap->kref);
- unmap->dev = dev;
+ unmap->dev = dmaengine_get_dma_device(chan);
unmap->map_cnt = nr;
return unmap;
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 2ae3469397f37..043bb065dd68a 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -748,7 +748,7 @@ static int dmatest_func(void *data)
filltime = ktime_add(filltime, diff);
}
- um = dmaengine_get_unmap_data(dma_dev, src->cnt + dst->cnt,
+ um = dmaengine_get_unmap_data(chan, src->cnt + dst->cnt,
GFP_KERNEL);
if (!um) {
failed_tests++;
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index c4e0dce3ca64e..dec01b6264d7a 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -794,7 +794,7 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan)
goto out;
}
- unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
+ unmap = dmaengine_get_unmap_data(dma_chan, 2, GFP_KERNEL);
if (!unmap) {
err = -ENOMEM;
goto free_resources;
@@ -927,7 +927,7 @@ mv_chan_xor_self_test(struct mv_xor_chan *mv_chan)
goto out;
}
- unmap = dmaengine_get_unmap_data(dma_chan->device->dev, src_count + 1,
+ unmap = dmaengine_get_unmap_data(dma_chan, src_count + 1,
GFP_KERNEL);
if (!unmap) {
err = -ENOMEM;
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index f9caa1a653c5b..e1cb55890d72b 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1532,7 +1532,7 @@ static int ntb_async_rx_submit(struct ntb_queue_entry *entry, void *offset)
if (!is_dma_copy_aligned(device, pay_off, buff_off, len))
goto err;
- unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
+ unmap = dmaengine_get_unmap_data(chan, 2, GFP_NOWAIT);
if (!unmap)
goto err;
@@ -1872,7 +1872,7 @@ static int ntb_async_tx_submit(struct ntb_transport_qp *qp,
if (!is_dma_copy_aligned(device, buff_off, dest_off, len))
goto err;
- unmap = dmaengine_get_unmap_data(device->dev, 1, GFP_NOWAIT);
+ unmap = dmaengine_get_unmap_data(chan, 1, GFP_NOWAIT);
if (!unmap)
goto err;
diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index dfd175f79e8f0..5fea36432ba92 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -809,7 +809,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
dst_vaddr = dst;
dst_dma_addr = peer->dma_dst_addr + (dst_vaddr - vbase);
- unmap = dmaengine_get_unmap_data(dma_dev, 1, GFP_NOWAIT);
+ unmap = dmaengine_get_unmap_data(pthr->dma_chan, 1, GFP_NOWAIT);
if (!unmap)
return -ENOMEM;
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 805668fbe4376..6d918ccf852f9 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -676,7 +676,7 @@ static inline void dma_set_unmap(struct dma_async_tx_descriptor *tx,
}
struct dmaengine_unmap_data *
-dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags);
+dmaengine_get_unmap_data(struct dma_chan *chan, int nr, gfp_t flags);
void dmaengine_unmap_put(struct dmaengine_unmap_data *unmap);
#else
static inline void dma_set_unmap(struct dma_async_tx_descriptor *tx,
@@ -684,7 +684,7 @@ static inline void dma_set_unmap(struct dma_async_tx_descriptor *tx,
{
}
static inline struct dmaengine_unmap_data *
-dmaengine_get_unmap_data(struct device *dev, int nr, gfp_t flags)
+dmaengine_get_unmap_data(struct dma_chan *chan, int nr, gfp_t flags)
{
return NULL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan *
2026-10-15 15:51 [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan Frank.Li
@ 2026-10-15 15:51 ` Frank.Li
2026-10-15 15:57 ` sashiko-bot
2026-10-15 16:01 ` [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan sashiko-bot
1 sibling, 1 reply; 4+ messages in thread
From: Frank.Li @ 2026-10-15 15:51 UTC (permalink / raw)
To: Dan Williams, Herbert Xu, David S. Miller, Vinod Koul, Frank Li,
Ard Biesheuvel, Andrew Morton, Dave Jiang, open list:CRYPTO API,
open list, open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
Cc: imx, Frank Li
From: Frank Li <Frank.Li@nxp.com>
Replace dma_maxpq() with dmaengine_maxpq(chan, flags) as a channel-based
API, consistent with the convention of other dmaengine_*() helpers that
take struct dma_chan * rather than struct dma_device *.
Signed-off-by: Frank Li <Frank.Li@nxp.com>
---
change in v4: none, just respin because missed patch 2
Change in v3
split from original thread
https://lore.kernel.org/dmaengine/20260923-dmaengine_prep_dma_pq-v2-0-32ed65b8a9b4@nxp.com/
---
crypto/async_tx/async_pq.c | 8 ++++----
drivers/dma/dmatest.c | 2 +-
include/linux/dmaengine.h | 6 ++++--
3 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
index 733af24a2762b..37bc48bbda821 100644
--- a/crypto/async_tx/async_pq.c
+++ b/crypto/async_tx/async_pq.c
@@ -51,7 +51,7 @@ do_async_gen_syndrome(struct dma_chan *chan,
while (src_cnt > 0) {
submit->flags = flags_orig;
- pq_src_cnt = min(src_cnt, dma_maxpq(dma, dma_flags));
+ pq_src_cnt = min(src_cnt, dmaengine_maxpq(chan, dma_flags));
/* if we are submitting additional pqs, leave the chain open,
* clear the callback parameters, and leave the destination
* buffers mapped
@@ -192,8 +192,8 @@ async_gen_syndrome(struct page **blocks, unsigned int *offsets, int disks,
/* XORing P/Q is only implemented in software */
if (unmap && !(submit->flags & ASYNC_TX_PQ_XOR_DST) &&
- (src_cnt <= dma_maxpq(device, 0) ||
- dma_maxpq(device, DMA_PREP_CONTINUE) > 0) &&
+ (src_cnt <= dmaengine_maxpq(chan, 0) ||
+ dmaengine_maxpq(chan, DMA_PREP_CONTINUE) > 0) &&
is_dma_pq_aligned_offs(device, offsets, disks, len)) {
struct dma_async_tx_descriptor *tx;
enum dma_ctrl_flags dma_flags = 0;
@@ -312,7 +312,7 @@ async_syndrome_val(struct page **blocks, unsigned int *offsets, int disks,
if (chan)
unmap = dmaengine_get_unmap_data(chan, disks, GFP_NOWAIT);
- if (unmap && disks <= dma_maxpq(device, 0) &&
+ if (unmap && disks <= dmaengine_maxpq(chan, 0) &&
is_dma_pq_aligned_offs(device, offsets, disks, len)) {
struct device *dev = device->dev;
dma_addr_t pq[2];
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 043bb065dd68a..01ab33580da81 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -636,7 +636,7 @@ static int dmatest_func(void *data)
params->alignment;
} else if (thread->type == DMA_PQ) {
/* force odd to ensure dst = src */
- src->cnt = min_odd(params->pq_sources | 1, dma_maxpq(dev, 0));
+ src->cnt = min_odd(params->pq_sources | 1, dmaengine_maxpq(chan, 0));
dst->cnt = 2;
align = params->alignment < 0 ? dev->pq_align :
params->alignment;
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 6d918ccf852f9..ef141892651d6 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -1720,7 +1720,7 @@ static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
return dma->max_pq & ~DMA_HAS_PQ_CONTINUE;
}
-/* dma_maxpq - reduce maxpq in the face of continued operations
+/* dmaengine_maxpq - reduce maxpq in the face of continued operations
* @dma - dma device with PQ capability
* @flags - to check if DMA_PREP_CONTINUE and DMA_PREP_PQ_DISABLE_P are set
*
@@ -1733,8 +1733,10 @@ static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
* In the case where P is disabled we only need 1 extra source:
* 1/ {01} * Q : use Q to continue Q' calculation
*/
-static inline int dma_maxpq(struct dma_device *dma, enum dma_ctrl_flags flags)
+static inline int dmaengine_maxpq(struct dma_chan *chan, enum dma_ctrl_flags flags)
{
+ struct dma_device *dma = chan->device;
+
if (dma_dev_has_pq_continue(dma) || !dmaf_continue(flags))
return dma_dev_to_maxpq(dma);
if (dmaf_p_disabled_continue(flags))
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan *
2026-10-15 15:51 ` [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan * Frank.Li
@ 2026-10-15 15:57 ` sashiko-bot
0 siblings, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-10-15 15:57 UTC (permalink / raw)
To: Frank.Li, open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
Cc: imx, vkoul, Frank.Li
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] dmaengine: stale documentation and comments after dma_maxpq rename
--
commit d1c8559bd7d041826990cfe2359c6880e20a68d4
Author: Frank Li <Frank.Li@nxp.com>
dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan *
This commit renames dma_maxpq() to dmaengine_maxpq() and updates it to take
a struct dma_chan pointer instead of a struct dma_device pointer. It also
updates the callers in the async_tx and dmatest subsystems to use the new
API convention.
Link: https://lore.kernel.org/dmaengine/20260923-dmaengine_prep_dma_pq-v2-0-32ed65b8a9b4@nxp.com/
> diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
> index c6c212ba33734..3edd80eed0a2a 100644
> --- a/include/linux/dmaengine.h
> +++ b/include/linux/dmaengine.h
[ ... ]
> @@ -1443,7 +1443,7 @@ static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
> return dma->max_pq & ~DMA_HAS_PQ_CONTINUE;
> }
>
> -/* dma_maxpq - reduce maxpq in the face of continued operations
> +/* dmaengine_maxpq - reduce maxpq in the face of continued operations
> * @dma - dma device with PQ capability
[Severity: Low]
Should this kernel-doc comment be updated to document the new @chan
parameter instead of the removed @dma parameter?
Additionally, it looks like there is a stale reference to the old function
name in drivers/dma/ioat/prep.c that says "see the comment for dma_maxpq in
include/linux/dmaengine.h". Does that file need to be updated in this patch
to reflect the rename?
> * @flags - to check if DMA_PREP_CONTINUE and DMA_PREP_PQ_DISABLE_P are set
> *
> @@ -1456,8 +1456,10 @@ static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
> * In the case where P is disabled we only need 1 extra source:
> * 1/ {01} * Q : use Q to continue Q' calculation
> */
> -static inline int dma_maxpq(struct dma_device *dma, enum dma_ctrl_flags flags)
> +static inline int dmaengine_maxpq(struct dma_chan *chan, enum dma_ctrl_flags flags)
> {
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261015155118.3063149-1-Frank.Li@oss.nxp.com?part=2
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan
2026-10-15 15:51 [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan Frank.Li
2026-10-15 15:51 ` [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan * Frank.Li
@ 2026-10-15 16:01 ` sashiko-bot
1 sibling, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-10-15 16:01 UTC (permalink / raw)
To: Frank.Li, open list:DMA GENERIC OFFLOAD ENGINE SUBSYSTEM,
open list:NTB DRIVER CORE
Cc: imx, vkoul, Frank.Li
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] dmaengine: Mismatched DMA device used for mapping and unmapping
- [High] dmaengine: NULL pointer dereference in dmaengine_get_dma_device() during mv_xor probe
--
commit 811fe2fcd19af9f3eb46610a12e2d1dc77b628e0
Author: Frank Li <Frank.Li@nxp.com>
dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan
This commit modifies dmaengine_get_unmap_data() to accept a dma_chan
instead of a device pointer, automatically resolving the correct DMA device
for the channel. It updates various callers in the crypto, NTB, and DMA
test subsystems to match this new signature.
Link: https://lore.kernel.org/dmaengine/20260923-dmaengine_prep_dma_pq-v2-0-32ed65b8a9b4@nxp.com/
Link: https://lore.kernel.org/imx/b40fa0d7-fbd0-4ee8-b99c-781d08c18838@intel.com/T/#t
> diff --git a/crypto/async_tx/async_memcpy.c b/crypto/async_tx/async_memcpy.c
> --- a/crypto/async_tx/async_memcpy.c
> +++ b/crypto/async_tx/async_memcpy.c
> @@ -39,8 +39,8 @@
> struct dma_async_tx_descriptor *tx = NULL;
> struct dmaengine_unmap_data *unmap = NULL;
>
> - if (device)
> - unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
> + if (chan)
> + unmap = dmaengine_get_unmap_data(chan, 2, GFP_NOWAIT);
[Severity: High]
Will this create a DMA API mapping mismatch for systems with per-channel IOMMUs?
The updated dmaengine_get_unmap_data() now sets unmap->dev using
dmaengine_get_dma_device(chan). If the channel supports a per-channel IOMMU,
this correctly resolves to the channel's specific device.
However, the memory mapping calls later in async_memcpy() still use the parent
device:
unmap->addr[0] = dma_map_page(device->dev, src, src_offset, len,
DMA_TO_DEVICE);
When the operation finishes, dmaengine_unmap() will attempt to unmap the
memory from unmap->dev (the child IOMMU device), while it was mapped to
device->dev (the parent device). This asymmetry can cause stranded IOMMU
mappings and invalid unmap page faults.
A similar mismatch appears in drivers/ntb/ntb_transport.c in
ntb_async_rx_submit(), which maps using device->dev instead of resolving
through the channel.
[ ... ]
> diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
> --- a/drivers/dma/mv_xor.c
> +++ b/drivers/dma/mv_xor.c
> @@ -789,7 +789,7 @@
> goto out;
> }
>
> - unmap = dmaengine_get_unmap_data(dma_chan->device->dev, 2, GFP_KERNEL);
> + unmap = dmaengine_get_unmap_data(dma_chan, 2, GFP_KERNEL);
[Severity: High]
Does this introduce a NULL pointer dereference during device probe?
In the mv_xor driver, mv_chan_memcpy_self_test() is called during driver
initialization via mv_xor_channel_add(). This happens before the channel
is fully registered with the DMA core.
At this point, the channel's sysfs device pointer chan->dev is not yet
allocated. When this patch changes the call to pass dma_chan instead of
dma_chan->device->dev, the implementation of dmaengine_get_unmap_data() will
call dmaengine_get_dma_device(chan).
Looking at include/linux/dmaengine.h:
static inline struct device *dmaengine_get_dma_device(struct dma_chan *chan)
{
if (chan->dev->chan_dma_dev)
return &chan->dev->device;
return chan->device->dev;
}
This unconditionally dereferences chan->dev, which is NULL during the
self-test, preventing the mv_xor driver from loading.
> if (!unmap) {
> err = -ENOMEM;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261015155118.3063149-1-Frank.Li@oss.nxp.com?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-15 16:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-15 15:51 [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan Frank.Li
2026-10-15 15:51 ` [PATCH v4 2/2] dmaengine: replace dma_maxqp() with dmaengine_maxpq() taking struct dma_chan * Frank.Li
2026-10-15 15:57 ` sashiko-bot
2026-10-15 16:01 ` [PATCH v4 1/2] dmaengine: change dmaengine_get_unmap_data() first arg to dma_chan sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox