Re: [PATCH] dmaengine: ste_dma40: Keep prepared descriptors across termination

[Frank Li <Frank.li@oss.nxp.com>]

On Wed, Nov 04, 2026 at 10:28:02PM +0100, Linus Walleij wrote:
> MMCI can prepare the next request while the current DMA transfer is
> running. If the current request fails, its error handler terminates the
> channel before the next descriptor has been submitted.
>
> d40_term_all() frees that descriptor from prepare_queue, although MMCI
> still holds its pointer. Submitting it later accesses freed memory in
> d40_tx_submit(). A reported crash writes to 0x104 through a list pointer
> containing LIST_POISON1, which is consistent with this sequence.
>
> Termination only cancels transfers that have been submitted. Leave
> prepared descriptors on prepare_queue so the client can still submit
> them, and release any remaining prepared descriptors when the channel
> resources are freed. Keep tracking them so abandoned descriptors are
> reclaimed at channel teardown.
>
> Fixes: 82babbb361f2 ("dmaengine/ste_dma40: fix memory leak due to prepared descriptors")
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/ste_dma40.c | 22 +++++++++-------------
>  1 file changed, 9 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index 74dd4cbdc3c0..f1cbc719c4f0 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -1166,14 +1166,6 @@ static void d40_term_all(struct d40_chan *d40c)
>  			d40_desc_free(d40c, d40d);
>  		}
>
> -	/* Release descriptors in prepare queue */
> -	if (!list_empty(&d40c->prepare_queue))
> -		list_for_each_entry_safe(d40d, _d,
> -					 &d40c->prepare_queue, node) {
> -			d40_desc_remove(d40d);
> -			d40_desc_free(d40c, d40d);
> -		}
> -
>  	d40c->pending_tx = 0;
>  }
>
> @@ -2222,7 +2214,8 @@ static int d40_config_memcpy(struct d40_chan *d40c)
>
>  static int d40_free_dma(struct d40_chan *d40c)
>  {
> -
> +	struct d40_desc *d40d;
> +	struct d40_desc *_d;
>  	int res = 0;
>  	u32 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.dev_type);
>  	struct d40_phy_res *phy = d40c->phy_chan;
> @@ -2252,6 +2245,12 @@ static int d40_free_dma(struct d40_chan *d40c)
>  	/* Release descriptor state; this does not access DMA40 registers. */
>  	d40_term_all(d40c);
>
> +	/* Release any prepared descriptors the client did not submit. */
> +	list_for_each_entry_safe(d40d, _d, &d40c->prepare_queue, node) {
> +		d40_desc_remove(d40d);
> +		d40_desc_free(d40c, d40d);
> +	}
> +
>  	res = pm_runtime_resume_and_get(d40c->base->dev);
>  	if (res >= 0) {
>  		res = d40_channel_execute_command(d40c, D40_DMA_STOP);
> @@ -2508,10 +2507,7 @@ d40_prep_sg(struct dma_chan *dchan, struct scatterlist *sg_src,
>  		goto free_desc;
>  	}
>
> -	/*
> -	 * add descriptor to the prepare queue in order to be able
> -	 * to free them later in terminate_all
> -	 */
> +	/* Track prepared descriptors until submission or channel release. */
>  	list_add_tail(&desc->node, &chan->prepare_queue);
>
>  	spin_unlock_irqrestore(&chan->lock, flags);
>
> ---
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
> change-id: 20261104-dma40-fixes-d9db6094b7d9
>
> Best regards,
> --
> Linus Walleij <linusw@kernel.org>
>