[v6,00/10] dmaengine: miscellaneous fixes for ioat, switchtec_dma and plx_dma

This is the latest series of fixes that has been rebased onto v7.3-rc1.

After getting more Sashiko feedback on the two problematic patches I
have to eat crow and appologize. Frank was correct about them and I
was a bit too stubborn. Sorry about that. I have dropped those two
patches in this series so hopefully it can go in quickly.

Please note: I'm going to be on vacation starting Friday the 4th until
the 15th so if there is any feedback in that window I'll respond when
I get back.

Thanks,

Logan

Changes since v5:
 * Dropped the two patches that skipped freeing the descriptor rings
   when the channel could not be confirmed halted ("always clear DMA
   base registers on chan_stop()" and "halt channel on
   alloc_chan_resources error"), per Frank's recommendation. All
   remaining patches are unchanged.

Changes since v4:
 * Rebased onto v7.3-rc1.
 * Added paragraph to patches 3 and 4 to make clear that they are
   leaking memory in favour of preventing theoretically buggy hardware
   from trashing re-used memory. I think this is the best thing to do.

Changes since v3:
 * Add a patch (3) making switchtec_dma_chan_stop() clear the DMA base
   registers even when halt_channel() times out, and return the halt
   result. switchtec_dma_free_chan_resources() (patch 3) and the
   alloc_chan_resources() error path (patch 4) now skip freeing the
   descriptor rings when the halt wasn't confirmed. This will leak some
   memory on tear down but that avoids broken hardware from scribbling
   on memory that may have been freed and reallocated. (Per Sashiko)
 * Remove each channel's list entry in switchtec_dma_chans_free()
   (patch 5), immediately before the memory is freed, instead of in
   switchtec_dma_chans_disable() (patch 8), which now only frees the
   channel status IRQ. (Per Sashiko)
 * Collected Reviewed-by tags from Frank and applied one of his
   commit message suggestions.

Changes since v2:

 * Fixed a race when unlisting the channels in the error path.
   The interrupt needed to be disabled before hand. (Per Sashiko)
 * Picked up Acked-by from Dave Jiang on the two ioat patches.

Changes since v1:

 * Added a fix for switchtec_dma_alloc_chan_resources()'s error path
   calling disable_channel() instead of properly halting the channel
   before freeing the descriptor rings. (Per Sashiko)
 * Added a fix for switchtec-dma channel structs being freed without
   being removed from dma_dev->channels on a registration failure,
   while the channel status IRQ is still live. (Per Sashiko)
 * Added a fix for switchtec_dma_remove() using swdma_dev after it may
   already have been freed by dma_async_device_unregister(). (Per
   Sashiko)
 * Added a fix for chan_status_irq being freed with the wrong API, and
   a valid vector index of 0 being incorrectly treated as unset.
   (Per Sashiko)
 * Made switchtec_dma_chans_release() void, since nothing checked its
   return value. (Noticed while reviewing the code for these changes).

Logan Gunthorpe (10):
  dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc()
  dmaengine: switchtec-dma: fix resource leak in alloc_chan_resources
  dmaengine: switchtec-dma: fix channel leak on registration failure
  dmaengine: switchtec-dma: make switchtec_dma_chans_release() void
  dmaengine: switchtec-dma: fix chan_status_irq cleanup on create()
    error
  dmaengine: switchtec-dma: disable channels before freeing on
    registration failure
  dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove()
  dmaengine: ioat: disable relaxed ordering before registering the
    device
  dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()
  dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr()

 drivers/dma/ioat/init.c     | 18 ++++-----
 drivers/dma/ioat/sysfs.c    | 22 +++++-----
 drivers/dma/plx_dma.c       | 10 ++---
 drivers/dma/switchtec_dma.c | 80 +++++++++++++++++++++++++++----------
 4 files changed, 84 insertions(+), 46 deletions(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
--
2.47.3

> Convert the sprintf() calls in the per-channel sysfs attribute show()
> functions to sysfs_emit().
> 
> Acked-by: Dave Jiang <dave.jiang@intel.com>
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> Signed-off-by: Logan Gunthorpe <logang@deltatee.com>

Sashiko has reviewed this patch and found no issues. It looks great!

Any update on when this might be merged? I thought it was ready to go
and I'd really like to see it in this cycle.

Thanks,

Logan

On Wed, 02 Sep 2026 00:21:42 -0600, Logan Gunthorpe wrote:
> This is the latest series of fixes that has been rebased onto v7.3-rc1.
> 
> After getting more Sashiko feedback on the two problematic patches I
> have to eat crow and appologize. Frank was correct about them and I
> was a bit too stubborn. Sorry about that. I have dropped those two
> patches in this series so hopefully it can go in quickly.
> 
> [...]

Applied, thanks!

[01/10] dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc()
        commit: bdfd76514bd11301f4e67d150485ab696c26d83d
[02/10] dmaengine: switchtec-dma: fix resource leak in alloc_chan_resources
        commit: 1188942d6160b9f799af297bdb5d7812cd7fde6d
[03/10] dmaengine: switchtec-dma: fix channel leak on registration failure
        commit: fd39726ab7096840cc9c9dea6dfba23834fc81f0
[04/10] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void
        commit: 50bf400915d308b80729bae8c6c85f001d7b7295
[05/10] dmaengine: switchtec-dma: fix chan_status_irq cleanup on create() error
        commit: 268f9159ebf38a7ed134e5008e705d8ff99e1c20
[06/10] dmaengine: switchtec-dma: disable channels before freeing on registration failure
        commit: 5b4c561554b2f802a4e3db539ba2c586b72b7721
[07/10] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove()
        commit: 9f744689c49defa61238836829202d1473da2ea5
[08/10] dmaengine: ioat: disable relaxed ordering before registering the device
        commit: 10d34fbca6e09a6a18d64fa3ebaa3db9f27fc1a6
[09/10] dmaengine: ioat: use sysfs_emit() in per-channel sysfs show()
        commit: c691357acf76037b8a58ee4eb0ae07cd708a8ba1
[10/10] dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr()
        commit: f3017892457d8bb664ea4b912910dc254e2dd825

Best regards,