Re: [PATCH] dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources

[Frank Li]

On Sat, Jul 18, 2026 at 04:52:27PM -0700, Rosen Penev wrote:
> fsl_re_free_chan_resources() loops alloc_count times calling
> list_first_entry() on free_q without checking whether the list still
> has entries. If descriptors remain un-acked or pending in submit_q /
> active_q / ack_q when the channel resources are freed, free_q becomes
> smaller than alloc_count and list_first_entry() returns the list head,
> causing list_del() to corrupt the list head and dereference a bogus
> pointer.
>
> Walk free_q with list_for_each_entry_safe() until it is empty,
> decrementing alloc_count per freed descriptor, instead of relying on
> the alloc_count count.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>  drivers/dma/fsl_raid.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index 30aaca81d855..db86f3e4e460 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -614,18 +614,15 @@ static int fsl_re_alloc_chan_resources(struct dma_chan *chan)
>  static void fsl_re_free_chan_resources(struct dma_chan *chan)
>  {
>  	struct fsl_re_chan *re_chan;
> -	struct fsl_re_desc *desc;
> +	struct fsl_re_desc *desc, *_desc;
>
>  	re_chan = container_of(chan, struct fsl_re_chan, chan);
> -	while (re_chan->alloc_count--) {
> -		desc = list_first_entry(&re_chan->free_q,
> -					struct fsl_re_desc,
> -					node);
> -
> +	list_for_each_entry_safe(desc, _desc, &re_chan->free_q, node) {
>  		list_del(&desc->node);
>  		dma_pool_free(re_chan->re_dev->cf_desc_pool, desc->cf_addr,
>  			      desc->cf_paddr);
>  		kfree(desc);
> +		re_chan->alloc_count--;
>  	}
>
>  	if (!list_empty(&re_chan->free_q))
> --
> 2.55.0
>