Re: [PATCH] thunderbolt: dma_test: Tear down DMA paths before stopping the rings

[Mika Westerberg]

Hi,

On Tue, Aug 25, 2026 at 11:47:59AM +0800, Haotian Zhang wrote:
> dma_test_stop_rings() stops the RX and TX rings before calling
> tb_xdomain_disable_paths().  tb_ring_stop() zeroes the ring's descriptor
> base and the cancellation callbacks unmap and free the frame buffers, so
> by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit any
> data still in flight has nowhere to drain to; on ASMedia ASM4242-class
> host routers the bit never clears and every teardown burns the full
> 500 ms timeout.  This is the same defect as the one in tbnet_tear_down(),
> fixed as CVE-2026-74691 ("net: thunderbolt: Tear down DMA paths before
> stopping the rings").
> 
> Move the tb_xdomain_disable_paths() call before the tb_ring_stop() calls
> in dma_test_stop_rings(), so in-flight data drains while the rings are
> still active, and only then stop the rings and free the frame buffers.
> 
> Fixes: edc0f494ed966 ("thunderbolt: Add DMA traffic test driver")
> Signed-off-by: Haotian Zhang <vulab@xxxxxxxxxxx>

I dropped the Fixes that as I don't think it's needed. DMA test is not
anything a regular user should care about anyways.

Applied to thunderbolt.git/next, thanks!