[PATCH 0/7] dmaengine: drain completion tasklets during teardown

[PATCH 0/7] dmaengine: drain completion tasklets during teardown

[Jiale Yao]

Several DMAengine drivers defer interrupt completion processing to
tasklets, but release channel resources without draining tasklets that
were already queued. Stopping or releasing an IRQ prevents new hard IRQ
handlers, but does not synchronize the deferred tasklet.

Depending on the driver, a late tasklet can access freed descriptor
storage or invoke a completion callback after its client data has been
released. Ensure each producer is stopped before killing the tasklet and
freeing the resources it can access.

Each patch is independent and keeps the synchronization local to one
driver's channel or device teardown path.

Jiale Yao (7):
  dmaengine: ep93xx: drain tasklet before freeing channel resources
  dmaengine: fsldma: drain channel tasklet during removal
  dmaengine: mmp_pdma: drain channel tasklets during removal
  dmaengine: mmp_tdma: synchronize tasklet when freeing a channel
  dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory
  dmaengine: mxs-dma: synchronize tasklet when freeing a channel
  dmaengine: ste_dma40: synchronize tasklet when releasing a channel

 drivers/dma/ep93xx_dma.c | 4 +++-
 drivers/dma/fsldma.c     | 1 +
 drivers/dma/mmp_pdma.c   | 4 ++++
 drivers/dma/mmp_tdma.c   | 2 ++
 drivers/dma/mv_xor.c     | 6 ++++--
 drivers/dma/mxs-dma.c    | 1 +
 drivers/dma/ste_dma40.c  | 2 ++
 7 files changed, 17 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 6/7] dmaengine: mxs-dma: synchronize tasklet when freeing a channel

[Jiale Yao]

The DMA interrupt handler schedules a per-channel tasklet to invoke the
completion callback. Releasing the IRQ does not drain a tasklet that was
already queued, so the callback can run after its client state has been
released.

Kill the tasklet after freeing the IRQ and before releasing the channel
command storage and clock.

Fixes: a580b8c5429a ("dmaengine: mxs-dma: add dma support for i.MX23/28")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/mxs-dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/mxs-dma.c b/drivers/dma/mxs-dma.c
index 7acb3d29dad3..9e85ba45f0fa 100644
--- a/drivers/dma/mxs-dma.c
+++ b/drivers/dma/mxs-dma.c
@@ -442,6 +442,7 @@ static void mxs_dma_free_chan_resources(struct dma_chan *chan)
 	mxs_dma_disable_chan(chan);
 
 	free_irq(mxs_chan->chan_irq, mxs_dma);
+	tasklet_kill(&mxs_chan->tasklet);
 
 	dma_free_coherent(mxs_dma->dma_device.dev, CCW_BLOCK_SIZE,
 			mxs_chan->ccw, mxs_chan->ccw_phys);
-- 
2.34.1

[PATCH 7/7] dmaengine: ste_dma40: synchronize tasklet when releasing a channel

[Jiale Yao]

DMA completion handling schedules a per-channel tasklet that processes
completed descriptors and invokes client callbacks. Channel release
terminates and frees the descriptor state without draining a tasklet
that was already queued.

After d40_free_dma() removes the channel from the interrupt lookup
tables, kill the tasklet before returning the channel to the DMAengine
core.

Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/dma/ste_dma40.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index 0d9ffa3e2663..647a265590c2 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -2484,6 +2484,8 @@ static void d40_free_chan_resources(struct dma_chan *chan)
 	if (err)
 		chan_err(d40c, "Failed to free channel\n");
 	spin_unlock_irqrestore(&d40c->lock, flags);
+
+	tasklet_kill(&d40c->tasklet);
 }
 
 static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
-- 
2.34.1

Re: [PATCH 7/7] dmaengine: ste_dma40: synchronize tasklet when releasing a channel

[Linus Walleij]

On Sun, Oct 18, 2026 at 6:07 AM Jiale Yao <yaojiale02@163.com> wrote:

> DMA completion handling schedules a per-channel tasklet that processes
> completed descriptors and invokes client callbacks. Channel release
> terminates and frees the descriptor state without draining a tasklet
> that was already queued.
>
> After d40_free_dma() removes the channel from the interrupt lookup
> tables, kill the tasklet before returning the channel to the DMAengine
> core.
>
> Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

This makes sense.
Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

Re: [PATCH 0/7] dmaengine: drain completion tasklets during teardown

[Peng Fan (OSS)]

On Sun, 18 Oct 2026 12:07:16 +0800 Jiale Yao <yaojiale02@163.com> wrote:

> Several DMAengine drivers defer interrupt completion processing to
> tasklets, but release channel resources without draining tasklets that
> were already queued. Stopping or releasing an IRQ prevents new hard IRQ
> handlers, but does not synchronize the deferred tasklet.
> 
> Depending on the driver, a late tasklet can access freed descriptor
> storage or invoke a completion callback after its client data has been
> released. Ensure each producer is stopped before killing the tasklet and
> freeing the resources it can access.
> 
> Each patch is independent and keeps the synchronization local to one
> driver's channel or device teardown path.
> 
> Jiale Yao (7):
>   dmaengine: ep93xx: drain tasklet before freeing channel resources
>   dmaengine: fsldma: drain channel tasklet during removal
>   dmaengine: mmp_pdma: drain channel tasklets during removal
>   dmaengine: mmp_tdma: synchronize tasklet when freeing a channel
>   dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory
>   dmaengine: mxs-dma: synchronize tasklet when freeing a channel
>   dmaengine: ste_dma40: synchronize tasklet when releasing a channel
> 
>  drivers/dma/ep93xx_dma.c | 4 +++-
>  drivers/dma/fsldma.c     | 1 +
>  drivers/dma/mmp_pdma.c   | 4 ++++
>  drivers/dma/mmp_tdma.c   | 2 ++
>  drivers/dma/mv_xor.c     | 6 ++++--
>  drivers/dma/mxs-dma.c    | 1 +
>  drivers/dma/ste_dma40.c  | 2 ++

You might need to add a bit more context on the issues.

Taking mxs-dma for example, it is non-SMP processor.

The normal completion path is:
1. DMA hardirq fires -> mxs_dma_int_handler() -> tasklet_schedule() -> raises TASKLET_SOFTIRQ
2. irq_exit() -> softirq processing -> tasklet_action() -> mxs_dma_tasklet() runs
3. Return to process context

The tasklet almost always completes before process context resumes.
The only way to hit the race on UP is if softirq processing gets deferred
to ksoftirqd, and then:
In PREEMPT_RT case: Tasklets become threaded and can interleave.
Is there a chance that in non-RT case, could we hit issues on UP processor?

Or I may understand wrong?

Regards
Peng

>  7 files changed, 17 insertions(+), 3 deletions(-)
> 
> -- 
> 2.34.1

Sent using hkml (https://github.com/sjp38/hackermail)

Re:Re: [PATCH 0/7] dmaengine: drain completion tasklets during teardown

[jiale yao]

Hi Peng,

At 2026-10-20 15:36:19, "Peng Fan (OSS)" <peng.fan@oss.nxp.com> wrote:
>On Sun, 18 Oct 2026 12:07:16 +0800 Jiale Yao <yaojiale02@163.com> wrote:
>
>> Several DMAengine drivers defer interrupt completion processing to
>> tasklets, but release channel resources without draining tasklets that
>> were already queued. Stopping or releasing an IRQ prevents new hard IRQ
>> handlers, but does not synchronize the deferred tasklet.
>> 
>> Depending on the driver, a late tasklet can access freed descriptor
>> storage or invoke a completion callback after its client data has been
>> released. Ensure each producer is stopped before killing the tasklet and
>> freeing the resources it can access.
>> 
>> Each patch is independent and keeps the synchronization local to one
>> driver's channel or device teardown path.
>> 
>> Jiale Yao (7):
>>   dmaengine: ep93xx: drain tasklet before freeing channel resources
>>   dmaengine: fsldma: drain channel tasklet during removal
>>   dmaengine: mmp_pdma: drain channel tasklets during removal
>>   dmaengine: mmp_tdma: synchronize tasklet when freeing a channel
>>   dmaengine: mv_xor: drain IRQ tasklet before freeing channel memory
>>   dmaengine: mxs-dma: synchronize tasklet when freeing a channel
>>   dmaengine: ste_dma40: synchronize tasklet when releasing a channel
>> 
>>  drivers/dma/ep93xx_dma.c | 4 +++-
>>  drivers/dma/fsldma.c     | 1 +
>>  drivers/dma/mmp_pdma.c   | 4 ++++
>>  drivers/dma/mmp_tdma.c   | 2 ++
>>  drivers/dma/mv_xor.c     | 6 ++++--
>>  drivers/dma/mxs-dma.c    | 1 +
>>  drivers/dma/ste_dma40.c  | 2 ++
>
>You might need to add a bit more context on the issues.
>
>Taking mxs-dma for example, it is non-SMP processor.
>
>The normal completion path is:
>1. DMA hardirq fires -> mxs_dma_int_handler() -> tasklet_schedule() -> raises TASKLET_SOFTIRQ
>2. irq_exit() -> softirq processing -> tasklet_action() -> mxs_dma_tasklet() runs
>3. Return to process context
>
>The tasklet almost always completes before process context resumes.
>The only way to hit the race on UP is if softirq processing gets deferred
>to ksoftirqd, and then:
>In PREEMPT_RT case: Tasklets become threaded and can interleave.
>Is there a chance that in non-RT case, could we hit issues on UP processor?
>
>Or I may understand wrong?

Thanks for the detailed analysis.

The normal UP/non-RT path usually runs the tasklet from irq_exit(), as
you described. However, if the DMA IRQ raises TASKLET_SOFTIRQ after that
vector has already been processed in the current softirq pass,
need_resched() or the softirq time/restart limits can defer it to
ksoftirqd. Process context may then release the channel before the
tasklet runs.

A similar teardown issue was fixed by commit 0ca79979384f
("RDMA/erdma: Fix CEQ tasklet use-after-free on removal"). free_irq()
synchronizes the hard IRQ handler, but does not drain an already queued
tasklet.

For mxs-dma, the deferred tasklet may invoke the completion callback
after its client data has been released. Therefore this can also happen
on UP/non-RT, although the window is narrow.

>
>Regards
>Peng
>
>>  7 files changed, 17 insertions(+), 3 deletions(-)
>> 
>> -- 
>> 2.34.1
>
>Sent using hkml (https://github.com/sjp38/hackermail)


Thanks,
Jiale