<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/drivers/dma/dmaengine.c, branch v6.12.80</title>
<subtitle>Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git</subtitle>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/'/>
<entry>
<title>dmaengine: avoid non-constant format string</title>
<updated>2024-08-29T17:19:53+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2024-07-19T10:23:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=ae04342b5264fcf90a288a984a69ffb9e93904a7'/>
<id>ae04342b5264fcf90a288a984a69ffb9e93904a7</id>
<content type='text'>
Using an arbitrary string as a printf-style format can be a security
problem if that string contains % characters, as the optionalal
-Wformat-security flag points out:

drivers/dma/dmaengine.c: In function '__dma_async_device_channel_register':
drivers/dma/dmaengine.c:1073:17: error: format not a string literal and no format arguments [-Werror=format-security]
 1073 |                 dev_set_name(&amp;chan-&gt;dev-&gt;device, name);
      |                 ^~~~~~~~~~~~

Change this newly added instance to use "%s" as the format instead to
pass the actual name.

Fixes: 10b8e0fd3f72 ("dmaengine: add channel device name to channel registration")
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20240719102319.546622-1-arnd@kernel.org
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Using an arbitrary string as a printf-style format can be a security
problem if that string contains % characters, as the optionalal
-Wformat-security flag points out:

drivers/dma/dmaengine.c: In function '__dma_async_device_channel_register':
drivers/dma/dmaengine.c:1073:17: error: format not a string literal and no format arguments [-Werror=format-security]
 1073 |                 dev_set_name(&amp;chan-&gt;dev-&gt;device, name);
      |                 ^~~~~~~~~~~~

Change this newly added instance to use "%s" as the format instead to
pass the actual name.

Fixes: 10b8e0fd3f72 ("dmaengine: add channel device name to channel registration")
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20240719102319.546622-1-arnd@kernel.org
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: add channel device name to channel registration</title>
<updated>2024-06-11T18:25:34+00:00</updated>
<author>
<name>Amelie Delaunay</name>
<email>amelie.delaunay@foss.st.com</email>
</author>
<published>2024-05-31T15:07:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=10b8e0fd3f7234a38db2c8d2c8dec0bd6eeede44'/>
<id>10b8e0fd3f7234a38db2c8d2c8dec0bd6eeede44</id>
<content type='text'>
Channel device name is used for sysfs, but also by dmatest filter function.

With dynamic channel registration, channels can be registered after dma
controller registration. Users may want to have specific channel names.

If name is NULL, the channel name relies on previous implementation,
dma&lt;controller_device_id&gt;chan&lt;channel_device_id&gt;.

Signed-off-by: Amelie Delaunay &lt;amelie.delaunay@foss.st.com&gt;
Link: https://lore.kernel.org/r/20240531150712.2503554-11-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Channel device name is used for sysfs, but also by dmatest filter function.

With dynamic channel registration, channels can be registered after dma
controller registration. Users may want to have specific channel names.

If name is NULL, the channel name relies on previous implementation,
dma&lt;controller_device_id&gt;chan&lt;channel_device_id&gt;.

Signed-off-by: Amelie Delaunay &lt;amelie.delaunay@foss.st.com&gt;
Link: https://lore.kernel.org/r/20240531150712.2503554-11-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: fix NULL pointer in channel unregistration function</title>
<updated>2023-12-21T16:14:29+00:00</updated>
<author>
<name>Amelie Delaunay</name>
<email>amelie.delaunay@foss.st.com</email>
</author>
<published>2023-12-13T16:04:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=f5c24d94512f1b288262beda4d3dcb9629222fc7'/>
<id>f5c24d94512f1b288262beda4d3dcb9629222fc7</id>
<content type='text'>
__dma_async_device_channel_register() can fail. In case of failure,
chan-&gt;local is freed (with free_percpu()), and chan-&gt;local is nullified.
When dma_async_device_unregister() is called (because of managed API or
intentionally by DMA controller driver), channels are unconditionally
unregistered, leading to this NULL pointer:
[    1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
[...]
[    1.484499] Call trace:
[    1.486930]  device_del+0x40/0x394
[    1.490314]  device_unregister+0x20/0x7c
[    1.494220]  __dma_async_device_channel_unregister+0x68/0xc0

Look at dma_async_device_register() function error path, channel device
unregistration is done only if chan-&gt;local is not NULL.

Then add the same condition at the beginning of
__dma_async_device_channel_unregister() function, to avoid NULL pointer
issue whatever the API used to reach this function.

Fixes: d2fb0a043838 ("dmaengine: break out channel registration")
Signed-off-by: Amelie Delaunay &lt;amelie.delaunay@foss.st.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
__dma_async_device_channel_register() can fail. In case of failure,
chan-&gt;local is freed (with free_percpu()), and chan-&gt;local is nullified.
When dma_async_device_unregister() is called (because of managed API or
intentionally by DMA controller driver), channels are unconditionally
unregistered, leading to this NULL pointer:
[    1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
[...]
[    1.484499] Call trace:
[    1.486930]  device_del+0x40/0x394
[    1.490314]  device_unregister+0x20/0x7c
[    1.494220]  __dma_async_device_channel_unregister+0x68/0xc0

Look at dma_async_device_register() function error path, channel device
unregistration is done only if chan-&gt;local is not NULL.

Then add the same condition at the beginning of
__dma_async_device_channel_unregister() function, to avoid NULL pointer
issue whatever the API used to reach this function.

Fixes: d2fb0a043838 ("dmaengine: break out channel registration")
Signed-off-by: Amelie Delaunay &lt;amelie.delaunay@foss.st.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: Simplify dma_async_device_register()</title>
<updated>2023-08-21T13:06:46+00:00</updated>
<author>
<name>Yajun Deng</name>
<email>yajun.deng@linux.dev</email>
</author>
<published>2023-08-15T07:23:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=81ebed8aa2c213939a4670f508031a57d4ecbb70'/>
<id>81ebed8aa2c213939a4670f508031a57d4ecbb70</id>
<content type='text'>
There are a lot of duplicate codes for checking if the dma has some
capability.

Define a temporary macro that is used to check if the dma claims some
capability and if the corresponding function is implemented.

Signed-off-by: Yajun Deng &lt;yajun.deng@linux.dev&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20230815072346.2798927-1-yajun.deng@linux.dev
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There are a lot of duplicate codes for checking if the dma has some
capability.

Define a temporary macro that is used to check if the dma claims some
capability and if the corresponding function is implemented.

Signed-off-by: Yajun Deng &lt;yajun.deng@linux.dev&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Link: https://lore.kernel.org/r/20230815072346.2798927-1-yajun.deng@linux.dev
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: Actually use devm_add_action_or_reset()</title>
<updated>2023-03-17T17:43:42+00:00</updated>
<author>
<name>Andy Shevchenko</name>
<email>andriy.shevchenko@linux.intel.com</email>
</author>
<published>2023-02-13T11:21:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=91e78b2585348284ef7cdb6a8736fd21389914fe'/>
<id>91e78b2585348284ef7cdb6a8736fd21389914fe</id>
<content type='text'>
It appears that the commit a1beaa50b583 ("dmaengine: Simplify
dmaenginem_async_device_register() function") mentions
devm_add_action_or_reset() the actual change utilised devm_add_action()
call by mistake.

Fix the issue by switching to devm_add_action_or_reset().

Fixes: a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function")
Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230213112138.32118-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
It appears that the commit a1beaa50b583 ("dmaengine: Simplify
dmaenginem_async_device_register() function") mentions
devm_add_action_or_reset() the actual change utilised devm_add_action()
call by mistake.

Fix the issue by switching to devm_add_action_or_reset().

Fixes: a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function")
Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230213112138.32118-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine</title>
<updated>2023-02-25T01:18:54+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2023-02-25T01:18:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=9e6bfd42b14b45737cae8bc84c759f1874949b8b'/>
<id>9e6bfd42b14b45737cae8bc84c759f1874949b8b</id>
<content type='text'>
Pull dmaengine updates from Vinod Koul:
 "A new driver, couple of device support and binding conversion along
  with bunch of driver updates are the main features of this.

  New hardware support:

   - TI AM62Ax controller support

   - Xilinx xdma driver

   - Qualcomm SM6125, SM8550, QDU1000/QRU1000 GPI controller

  Updates:

   - Runtime pm support for at_xdmac driver

   - IMX sdma binding conversion to yaml and HDMI audio support

   - IMX mxs binding conversion to yaml"

* tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (35 commits)
  dmaengine: idma64: Update bytes_transferred field
  dmaengine: imx-sdma: Set DMA channel to be private
  dmaengine: dw: Move check for paused channel to dwc_get_residue()
  dmaengine: ptdma: check for null desc before calling pt_cmd_callback
  dmaengine: dw-axi-dmac: Do not dereference NULL structure
  dmaengine: idxd: Fix default allowed read buffers value in group
  dmaengine: sf-pdma: pdma_desc memory leak fix
  dmaengine: Simplify dmaenginem_async_device_register() function
  dmaengine: use sysfs_emit() to instead of scnprintf()
  dmaengine: Make an order in struct dma_device definition
  dt-bindings: dma: cleanup examples - indentation, lowercase hex
  dt-bindings: dma: drop unneeded quotes
  dmaengine: xilinx: xdma: Add user logic interrupt support
  dmaengine: xilinx: xdma: Add xilinx xdma driver
  dmaengine: drivers: Use devm_platform_ioremap_resource()
  dmaengine: at_xdmac: remove empty line
  dmaengine: at_xdmac: add runtime pm support
  dmaengine: at_xdmac: align properly function members
  dmaengine: ppc4xx: Convert to use sysfs_emit()/sysfs_emit_at() APIs
  dmaengine: sun6i: Set the maximum segment size
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull dmaengine updates from Vinod Koul:
 "A new driver, couple of device support and binding conversion along
  with bunch of driver updates are the main features of this.

  New hardware support:

   - TI AM62Ax controller support

   - Xilinx xdma driver

   - Qualcomm SM6125, SM8550, QDU1000/QRU1000 GPI controller

  Updates:

   - Runtime pm support for at_xdmac driver

   - IMX sdma binding conversion to yaml and HDMI audio support

   - IMX mxs binding conversion to yaml"

* tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (35 commits)
  dmaengine: idma64: Update bytes_transferred field
  dmaengine: imx-sdma: Set DMA channel to be private
  dmaengine: dw: Move check for paused channel to dwc_get_residue()
  dmaengine: ptdma: check for null desc before calling pt_cmd_callback
  dmaengine: dw-axi-dmac: Do not dereference NULL structure
  dmaengine: idxd: Fix default allowed read buffers value in group
  dmaengine: sf-pdma: pdma_desc memory leak fix
  dmaengine: Simplify dmaenginem_async_device_register() function
  dmaengine: use sysfs_emit() to instead of scnprintf()
  dmaengine: Make an order in struct dma_device definition
  dt-bindings: dma: cleanup examples - indentation, lowercase hex
  dt-bindings: dma: drop unneeded quotes
  dmaengine: xilinx: xdma: Add user logic interrupt support
  dmaengine: xilinx: xdma: Add xilinx xdma driver
  dmaengine: drivers: Use devm_platform_ioremap_resource()
  dmaengine: at_xdmac: remove empty line
  dmaengine: at_xdmac: add runtime pm support
  dmaengine: at_xdmac: align properly function members
  dmaengine: ppc4xx: Convert to use sysfs_emit()/sysfs_emit_at() APIs
  dmaengine: sun6i: Set the maximum segment size
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: Simplify dmaenginem_async_device_register() function</title>
<updated>2023-02-10T06:07:45+00:00</updated>
<author>
<name>Andy Shevchenko</name>
<email>andriy.shevchenko@linux.intel.com</email>
</author>
<published>2023-01-30T11:28:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=a1beaa50b583a4f137048ff6e55bd2328a4e4362'/>
<id>a1beaa50b583a4f137048ff6e55bd2328a4e4362</id>
<content type='text'>
Use devm_add_action_or_reset() instead of devres_alloc() and
devres_add(), which works the same. This will simplify the
code. There is no functional changes.

Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230130112830.52353-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use devm_add_action_or_reset() instead of devres_alloc() and
devres_add(), which works the same. This will simplify the
code. There is no functional changes.

Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230130112830.52353-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: use sysfs_emit() to instead of scnprintf()</title>
<updated>2023-02-10T06:07:45+00:00</updated>
<author>
<name>Andy Shevchenko</name>
<email>andriy.shevchenko@linux.intel.com</email>
</author>
<published>2023-01-30T11:11:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=40e171c2d306e42057433fb2c2f1fee2d385e1c4'/>
<id>40e171c2d306e42057433fb2c2f1fee2d385e1c4</id>
<content type='text'>
Follow the advice of the Documentation/filesystems/sysfs.rst and show()
should only use sysfs_emit() or sysfs_emit_at() when formatting the
value to be returned to user space.

Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230130111141.59627-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Follow the advice of the Documentation/filesystems/sysfs.rst and show()
should only use sysfs_emit() or sysfs_emit_at() when formatting the
value to be returned to user space.

Signed-off-by: Andy Shevchenko &lt;andriy.shevchenko@linux.intel.com&gt;
Link: https://lore.kernel.org/r/20230130111141.59627-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: Fix double increment of client_count in dma_chan_get()</title>
<updated>2023-01-18T12:06:49+00:00</updated>
<author>
<name>Koba Ko</name>
<email>koba.ko@canonical.com</email>
</author>
<published>2022-12-01T03:00:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=f3dc1b3b4750851a94212dba249703dd0e50bb20'/>
<id>f3dc1b3b4750851a94212dba249703dd0e50bb20</id>
<content type='text'>
The first time dma_chan_get() is called for a channel the channel
client_count is incorrectly incremented twice for public channels,
first in balance_ref_count(), and again prior to returning. This
results in an incorrect client count which will lead to the
channel resources not being freed when they should be. A simple
 test of repeated module load and unload of async_tx on a Dell
 Power Edge R7425 also shows this resulting in a kref underflow
 warning.

[  124.329662] async_tx: api initialized (async)
[  129.000627] async_tx: api initialized (async)
[  130.047839] ------------[ cut here ]------------
[  130.052472] refcount_t: underflow; use-after-free.
[  130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28
refcount_warn_saturate+0xba/0x110
[  130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr
intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm
mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si
syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops
k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat
fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul
libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas
i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash
dm_log dm_mod [last unloaded: async_tx]
[  130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not
tainted 5.14.0-185.el9.x86_64 #1
[  130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS
1.18.0 01/17/2022
[  130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110
[  130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d
26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a
bd 55 00 &lt;0f&gt; 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff
48 c7
[  130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286
[  130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000
[  130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0
[  130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff
[  130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970
[  130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  130.198739] FS:  00007f646435c740(0000) GS:ffff9daf9de00000(0000)
knlGS:0000000000000000
[  130.206832] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0
[  130.219729] Call Trace:
[  130.222192]  &lt;TASK&gt;
[  130.224305]  dma_chan_put+0x10d/0x110
[  130.227988]  dmaengine_put+0x7a/0xa0
[  130.231575]  __do_sys_delete_module.constprop.0+0x178/0x280
[  130.237157]  ? syscall_trace_enter.constprop.0+0x145/0x1d0
[  130.242652]  do_syscall_64+0x5c/0x90
[  130.246240]  ? exc_page_fault+0x62/0x150
[  130.250178]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  130.255243] RIP: 0033:0x7f6463a3f5ab
[  130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48
83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00
00 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89
01 48
[  130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX:
00000000000000b0
[  130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab
[  130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8
[  130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000
[  130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8
[  130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8
[  130.320875]  &lt;/TASK&gt;
[  130.323081] ---[ end trace eff7156d56b5cf25 ]---

cat /sys/class/dma/dma0chan*/in_use would get the wrong result.
2
2
2

Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get")
Signed-off-by: Koba Ko &lt;koba.ko@canonical.com&gt;
Reviewed-by: Jie Hai &lt;haijie1@huawei.com&gt;
Test-by: Jie Hai &lt;haijie1@huawei.com&gt;
Reviewed-by: Jerry Snitselaar &lt;jsnitsel@redhat.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Tested-by: Joel Savitz &lt;jsavitz@redhat.com&gt;
Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The first time dma_chan_get() is called for a channel the channel
client_count is incorrectly incremented twice for public channels,
first in balance_ref_count(), and again prior to returning. This
results in an incorrect client count which will lead to the
channel resources not being freed when they should be. A simple
 test of repeated module load and unload of async_tx on a Dell
 Power Edge R7425 also shows this resulting in a kref underflow
 warning.

[  124.329662] async_tx: api initialized (async)
[  129.000627] async_tx: api initialized (async)
[  130.047839] ------------[ cut here ]------------
[  130.052472] refcount_t: underflow; use-after-free.
[  130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28
refcount_warn_saturate+0xba/0x110
[  130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr
intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm
mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si
syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops
k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat
fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul
libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas
i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash
dm_log dm_mod [last unloaded: async_tx]
[  130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not
tainted 5.14.0-185.el9.x86_64 #1
[  130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS
1.18.0 01/17/2022
[  130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110
[  130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d
26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a
bd 55 00 &lt;0f&gt; 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff
48 c7
[  130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286
[  130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000
[  130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0
[  130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff
[  130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970
[  130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[  130.198739] FS:  00007f646435c740(0000) GS:ffff9daf9de00000(0000)
knlGS:0000000000000000
[  130.206832] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0
[  130.219729] Call Trace:
[  130.222192]  &lt;TASK&gt;
[  130.224305]  dma_chan_put+0x10d/0x110
[  130.227988]  dmaengine_put+0x7a/0xa0
[  130.231575]  __do_sys_delete_module.constprop.0+0x178/0x280
[  130.237157]  ? syscall_trace_enter.constprop.0+0x145/0x1d0
[  130.242652]  do_syscall_64+0x5c/0x90
[  130.246240]  ? exc_page_fault+0x62/0x150
[  130.250178]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  130.255243] RIP: 0033:0x7f6463a3f5ab
[  130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48
83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00
00 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89
01 48
[  130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX:
00000000000000b0
[  130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab
[  130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8
[  130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000
[  130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8
[  130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8
[  130.320875]  &lt;/TASK&gt;
[  130.323081] ---[ end trace eff7156d56b5cf25 ]---

cat /sys/class/dma/dma0chan*/in_use would get the wrong result.
2
2
2

Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get")
Signed-off-by: Koba Ko &lt;koba.ko@canonical.com&gt;
Reviewed-by: Jie Hai &lt;haijie1@huawei.com&gt;
Test-by: Jie Hai &lt;haijie1@huawei.com&gt;
Reviewed-by: Jerry Snitselaar &lt;jsnitsel@redhat.com&gt;
Reviewed-by: Dave Jiang &lt;dave.jiang@intel.com&gt;
Tested-by: Joel Savitz &lt;jsavitz@redhat.com&gt;
Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dmaengine: remove DMA_MEMCPY_SG once again</title>
<updated>2022-06-27T06:31:40+00:00</updated>
<author>
<name>Christoph Hellwig</name>
<email>hch@lst.de</email>
</author>
<published>2022-06-06T07:47:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.exis.tech/linux.git/commit/?id=0cae04373b77a117830e5f7d7aaa7eaf01f950d5'/>
<id>0cae04373b77a117830e5f7d7aaa7eaf01f950d5</id>
<content type='text'>
This was removed before due to the complete lack of users, but
3218910fd585 ("dmaengine: Add core function and capability check for
DMA_MEMCPY_SG") and 29cf37fa6dd9 ("dmaengine: Add consumer for the new
DMA_MEMCPY_SG API function.") added it back despite still not having
any users whatsoever.

Fixes: 3218910fd585 ("dmaengine: Add core function and capability check for DMA_MEMCPY_SG")
Fixes: 29cf37fa6dd9 ("dmaengine: Add consumer for the new DMA_MEMCPY_SG API function.")
Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Michal Simek &lt;michal.simek@amd.com&gt;
Link: https://lore.kernel.org/r/20220606074733.622616-1-hch@lst.de
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This was removed before due to the complete lack of users, but
3218910fd585 ("dmaengine: Add core function and capability check for
DMA_MEMCPY_SG") and 29cf37fa6dd9 ("dmaengine: Add consumer for the new
DMA_MEMCPY_SG API function.") added it back despite still not having
any users whatsoever.

Fixes: 3218910fd585 ("dmaengine: Add core function and capability check for DMA_MEMCPY_SG")
Fixes: 29cf37fa6dd9 ("dmaengine: Add consumer for the new DMA_MEMCPY_SG API function.")
Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Acked-by: Michal Simek &lt;michal.simek@amd.com&gt;
Link: https://lore.kernel.org/r/20220606074733.622616-1-hch@lst.de
Signed-off-by: Vinod Koul &lt;vkoul@kernel.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
