[PATCH v2 0/4] dmaengine: dma-axi-dmac: Some memory related fixes
From: Nuno Sá via B4 Relay
Date: Fri Mar 27 2026 - 12:58:28 EST
Ok, I rushed into v2 because I saw (based on AI review) that I already
had some fundamental issues. Some fairly straight (a bit embarrassing tbh)
but others not so much. Another thing to notice is that I changed the
order between "fix use-after-free on unbind" and "Defer freeing DMA
descriptors" because it just makes more sense given that using the
worker only works 100% if we don't have our DMA object bounded with the
platform driver.
Anyways, more details on the changelog.
Also note the addition of two new patches. The dmaengine one seems legit
but I want to note it was just by code inspection.
Signed-off-by: Nuno Sá <nuno.sa@xxxxxxxxxx>
---
Changes in v2:
- Patch 1:
* New patch.
- Patch 2:
* New patch.
- Patch 3:
* Use __free() to allocate the ojject so we don't leak in early
errors. Note that after dmaenginem_async_device_register(), the
object lifetime is handled by dmaengine;
* Move get_device() to after registering the device;
* Still allow to free DMA descriptors in axi_dmac_terminate_all();
* Use spin_lock_irqsave() to avoid possible deadlocks.
* Include spinlock.h
- Patch 4:
* Include workqueue.h;
* Save struct device directly in struct axi_dmac_desc and get a
reference when allocating. Give the reference when freeing the
descriptor.
- Link to v1: https://patch.msgid.link/20260326-dma-dmac-handle-vunmap-v1-0-be3e46ffaf69@xxxxxxxxxx
---
Eliza Balas (1):
dmaengine: dma-axi-dmac: Defer freeing DMA descriptors
Nuno Sá (3):
dmaengine: Fix possuible use after free
dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc
dmaengine: dma-axi-dmac: fix use-after-free on unbind
drivers/dma/dma-axi-dmac.c | 122 ++++++++++++++++++++++++++++++++++++---------
drivers/dma/dmaengine.c | 3 +-
2 files changed, 100 insertions(+), 25 deletions(-)
---
base-commit: b7560798466a07d9c3fb011698e92c335ab28baf
change-id: 20260325-dma-dmac-handle-vunmap-84a06df7d133
--
Thanks!
- Nuno Sá