From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CF5835AC35 for ; Mon, 20 Apr 2026 12:34:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776688462; cv=none; b=nuYyhh+ZwLw26LBItpnSCuTk83NazKXtQxbRIokWnqnd44iT48TC4Tx/FwJdvlYtMLU+ZtGXe6tOE7k75+2WRWuCgfDdFa3pnYZRentTILyliO8mPAyoZ2Qp5IKZxN1fBQsYdK2LfnF+hs4ZCFkNhZhb8eEivjdAL7ZaYapMojQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776688462; c=relaxed/simple; bh=JbZKB0n+GFV0OBpzIrmVAI6C9Bk53uw2sEoaPlhHCOs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=f7RidJ6jh29UcGVLE376gCaowpI+w63NYw2iu54sCZhsT916v2Hh+UxfydrOuKd0etz9Ng5dvQjIGUBD5veFTPHR8ISUpr6Jj72Oh9OhcpJyfXmys+Djnz8/Y2n217k/H2tdXrigcpn6fmKvii3ggFM4HdRp60LqI73uoSD87RM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tuxon.dev; spf=pass smtp.mailfrom=tuxon.dev; dkim=pass (2048-bit key) header.d=tuxon.dev header.i=@tuxon.dev header.b=JMI6Xm92; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tuxon.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=tuxon.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=tuxon.dev header.i=@tuxon.dev header.b="JMI6Xm92" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-488a9033b2cso33854455e9.2 for ; Mon, 20 Apr 2026 05:34:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tuxon.dev; s=google; t=1776688459; x=1777293259; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=RdpW+5L4fuwiJNGl1s+W8ELjLb4UMMlsktWZrXN7fjU=; b=JMI6Xm9234mhSr/51NNFxYM/mKCvbQCVbxh9WTi+u0uT7ozB37Xdf7USzS8OYoEKBN ZWXAGTd51aVkBMn3kYc84KAyzpWHy/B7697CQnFDWW/EvWAiYvmK6kzV2a5STG4RHXme wJx02MD5ZAr+oZlp8ZrEchgnTAaGCK/CGKVmoe/vpIQvoholGlmPoBBpPcLOm95SQA4s TDrDFCGgGbJo3GYpTYe9baILM4RcY0bi2WdALtXMXHXVgEVKBYGOdQrR1YKm0rRjHUC0 slZjHlcX8RC35JEIIuE8aZqsVQHlNGPqgnWy+doMo23IS+YFxJXOJvM0cmSbWxrfpqsF m4lA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776688459; x=1777293259; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=RdpW+5L4fuwiJNGl1s+W8ELjLb4UMMlsktWZrXN7fjU=; b=HFrA3CHDBty+5958qSEldEHkPqBpqqrdrPlT0WH/tziU6VaZCPQKWK6C8mdjtsGcLv we4CRaDR2su+YwvwuxPcXEotA7zWNCrqZm9q/jjbnZfferZ+Kst3O2gwCMU9OWg4p7Z4 BLBLivjpFSeAmBmTRxDKPAOOkazDuqRoZof5l5H9BCBF0/FViKz7MUVSAe3VP7tYexnV jlfL/s8sDUURmdbgiJ56D1lj3D3Aj9wiWBIvt4CiDhtP11+sow5TNcof2tRP7Zc0lGJH EmTwESUpD9Ao4l/7qa4ikzYbu9C4EJKr4pDOmyrhny/kTSSwEHnY/f6JO77mTcS7S450 r4BQ== X-Forwarded-Encrypted: i=1; AFNElJ9KidgGQW7jpxFsOE+EiLBNF33/ANuuBf/L18p47Cz6oDdmm4wttdWS0fTiR+Fa76J1TTFYG6gWRWZBow==@vger.kernel.org X-Gm-Message-State: AOJu0YxGVy/P8JuA9BU0N+tXTFdgibFvHVOsmDZ9opPo8BwUVTs64hla k0z+EUQkJurRxlMyyk4Vnd+DaF4vFTW4pK1vh7eBy+dhxVSnTW45nMD+JSVX2NU1E8s= X-Gm-Gg: AeBDietT809cYmertqBctLAq4EH35M4kpbeeflBkETbiVqoJrS+USzanyI/HPRqL9DR Rf4Xixo/hbNME7QidzimJabc3/XrSvuydXFYRYhmtGMf4X+0P0GOpWqV/Hh9I7o9TPFz5/WZ5dJ t8d/LZAA0feWn/qcbh3TahxQ1x3v128laObFeBtHi8Fk/ipVMdG+imneyHkBxW3YYHcvIbZuj6t yp7y0GtMNkYoQb/iZsmj5voOuTKe4sRtndZp4pYCmAtyact2f5Sm/A/Cpwmw1pP06Tm1fz5UN/e HJvEzmksnjGnL0JeQ/1SR4U+NiitXTH3j7Rd4yUEm+zlomXKJ+Hv6zeBDbVdWZpUkvm2gSPTLLe pyz2jMyFFNZRExrDUHeDgbshvjSDlvUuubkVkg1VM81IyTYE8zST7InwZSTpjvgupyI+CcNeSUb H9KX5wZz2Ox7n2bBI2GJ/zN2YMi9JfOsacggx19l+6yQ== X-Received: by 2002:a05:600c:4e8f:b0:489:1fa5:997f with SMTP id 5b1f17b1804b1-4891fa59adfmr35778405e9.9.1776688458190; Mon, 20 Apr 2026 05:34:18 -0700 (PDT) Received: from [192.168.50.4] ([82.78.167.123]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488fc13938fsm427469375e9.10.2026.04.20.05.34.16 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 20 Apr 2026 05:34:17 -0700 (PDT) Message-ID: <25318dd3-5892-4db1-97db-afb1c4b263a3@tuxon.dev> Date: Mon, 20 Apr 2026 15:34:16 +0300 Precedence: bulk X-Mailing-List: linux-sound@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: sashiko.dev review (Re: [PATCH v4 04/17] dmaengine: sh: rz-dmac: Use rz_dmac_disable_hw()) To: vkoul@kernel.org, Frank.Li@kernel.org, lgirdwood@gmail.com, broonie@kernel.org, perex@perex.cz, tiwai@suse.com, biju.das.jz@bp.renesas.com, prabhakar.mahadev-lad.rj@bp.renesas.com, p.zabel@pengutronix.de, geert+renesas@glider.be, fabrizio.castro.jz@renesas.com, long.luu.ur@renesas.com Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org, linux-sound@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Claudiu Beznea References: <20260411114303.2814115-1-claudiu.beznea.uj@bp.renesas.com> <20260411114303.2814115-5-claudiu.beznea.uj@bp.renesas.com> Content-Language: en-US From: Claudiu Beznea In-Reply-To: <20260411114303.2814115-5-claudiu.beznea.uj@bp.renesas.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit > commit f7b3ac8bceb85f09d10e2c6b3d49ae768415c77c > Author: Claudiu Beznea > dmaengine: sh: rz-dmac: Use rz_dmac_disable_hw() > This patch unifies the hardware disable code by replacing an open-coded > register write with rz_dmac_disable_hw(), moving it after vchan_init() > so the channel device is properly initialized. > > diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c > > index 1717b407ab9e9..40ddf534c0948 100644 > > --- a/drivers/dma/sh/rz-dmac.c > > +++ b/drivers/dma/sh/rz-dmac.c > [ ... ] > > @@ -1000,15 +1000,15 @@ static int rz_dmac_chan_probe(struct rz_dmac *dmac, > > } > > rz_lmdesc_setup(channel, lmdesc); > > > > - /* Initialize register for each channel */ > > - rz_dmac_ch_writel(channel, CHCTRL_DEFAULT, CHCTRL, 1); > > - > > channel->vc.desc_free = rz_dmac_virt_desc_free; > > vchan_init(&channel->vc, &dmac->engine); > This is not a bug introduced by this patch, but seeing the vchan > initialization here made me wonder about the driver teardown path. > When vchan_init() is called, it sets up a background tasklet for the > channel. During driver removal in rz_dmac_remove(), the DMA device is > unregistered, but it does not appear that tasklet_kill() is ever called > for this tasklet. > Because the channel structures are allocated with devm_kzalloc, their > memory is automatically freed immediately after rz_dmac_remove() returns. > If a DMA transfer is active when the driver is forcefully unbound, could > the IRQ thread schedule the tasklet via vchan_cookie_complete() right > before the IRQ is freed by devres? > Since free_irq() waits for the IRQ thread to finish but does not flush > tasklets, could this scheduled tasklet execute after the device memory > has been freed, resulting in a use-after-free? > Should the driver explicitly kill the tasklet before returning from > rz_dmac_remove()? > > INIT_LIST_HEAD(&channel->ld_queue); > > INIT_LIST_HEAD(&channel->ld_free); > > INIT_LIST_HEAD(&channel->ld_active); tasklet_setup() only sets the members of a struct tasklet object. The tasklet itself is scheduled at runtime when the DMA clients requests transfers. On remove the DMA clients would have already been called the rz_dmac_terminate_all() and/or rz_dmac_device_synchronize() which should kill the previously scheduled tasklet.