laptop-kernel/drivers/dma, branch master

dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate

2025-09-02T09:31:51Z

The reference taken by of_find_device_by_node() must be released when not needed anymore. Add missing put_device() call to fix device reference leaks. Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250902090358.2423285-1-linmq006@gmail.com Signed-off-by: Vinod Koul

dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

2025-09-02T06:35:18Z

Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure. Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/") Signed-off-by: Anders Roxell Link: https://lore.kernel.org/r/20250830094953.3038012-1-anders.roxell@linaro.org Signed-off-by: Vinod Koul

dmaengine: idxd: Fix double free in idxd_setup_wqs()

2025-08-20T17:32:04Z

The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located. Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs") Reported-by: Colin Ian King Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/ Signed-off-by: Dan Carpenter Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain Signed-off-by: Vinod Koul

dmaengine: idxd: Fix refcount underflow on module unload

2025-08-20T17:29:58Z

A recent refactor introduced a misplaced put_device() call, resulting in a reference count underflow during module unload. There is no need to add additional put_device() calls for idxd groups, engines, or workqueues. Although the commit claims: "Note, this also fixes the missing put_device() for idxd groups, engines, and wqs." It appears no such omission actually existed. The required cleanup is already handled by the call chain: idxd_unregister_devices() -> device_unregister() -> put_device() Extend idxd_cleanup() to handle the remaining necessary cleanup and remove idxd_cleanup_internals(), which duplicates deallocation logic for idxd, engines, groups, and workqueues. Memory management is also properly handled through the Linux device model. Fixes: a409e919ca32 ("dmaengine: idxd: Refactor remove call with idxd_cleanup() helper") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-3-yi.sun@intel.com Signed-off-by: Vinod Koul

dmaengine: idxd: Remove improper idxd_free

2025-08-20T17:29:58Z

The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload. Fixes: d5449ff1b04d ("dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-2-yi.sun@intel.com Signed-off-by: Vinod Koul

dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees

2025-08-11T05:22:43Z

When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In this case, we need to read num-channels from the DT to have all the necessary information to complete probing. However, at the moment invalid device trees without clock and without num-channels still continue probing, because the error handling is missing return statements. The driver will then later try to read the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes by erroring out when any of the required DT properties are missing. Note that this will break some of the existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the crypto engine for these broken DTBs. [1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/ [2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/ Cc: stable@vger.kernel.org Fixes: 48d163b1aa6e ("dmaengine: qcom: bam_dma: get num-channels and num-ees from dt") Signed-off-by: Stephan Gerhold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250212-bam-dma-fixes-v1-8-f560889e65d8@linaro.org Signed-off-by: Vinod Koul

Merge tag 'dmaengine-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

2025-08-01T19:35:12Z

Pull dmaengine updates from Vinod Koul: "Core: - Managed API for dma channel request New support: - Sophgo CV18XX/SG200X dmamux driver - Qualcomm Milos GPI, sc8280xp GPI support Updates: - Conversion of brcm,iproc-sba and marvell,orion-xor binding - Unused code cleanup across drivers" * tag 'dmaengine-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (23 commits) dt-bindings: dma: fsl-mxs-dma: allow interrupt-names for fsl,imx23-dma-apbx dmaengine: xdmac: make it selectable for ARCH_MICROCHIP dt-bindings: dma: Convert marvell,orion-xor to DT schema dt-bindings: dma: Convert brcm,iproc-sba to DT schema dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap dt-bindings: dma: qcom,gpi: document the Milos GPI DMA Engine dmaengine: idxd: Remove __packed from structures dmaengine: ti: Do not enable by default during compile testing dmaengine: sh: Do not enable SH_DMAE_BASE by default during compile testing dmaengine: idxd: Fix warning for deadcode.deadstore dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning dmaengine: fsl-qdma: Add missing fsl_qdma_format kerneldoc dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() dmaengine: fsl-dpaa2-qdma: Drop unused mc_enc() dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() dmaengine: stm32: Don't use %pK through printk dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs dmaengine: sun4i: Simplify error handling in probe() dt-bindings: dma: qcom,gpi: Document the sc8280xp GPI DMA engine ...

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

2025-07-31T20:36:27Z

Pull clk updates from Stephen Boyd: "This is the usual collection of primarily clk driver updates. The big part of the diff is all the new Qualcomm clk drivers added for a few SoCs they're working on. The other two vendors with significant work this cycle are Renesas and Amlogic. Renesas adds a bunch of clks to existing drivers and supports some new SoCs while Amlogic is starting a significant refactoring to simplify their code. The core framework gained a pair of helpers to get the 'struct device' or 'struct device_node' associated with a 'struct clk_hw'. Some associated KUnit tests were added for these simple helpers as well. Beyond that core change there are lots of little fixes throughout the clk drivers for the stuff we see every day, wrong clk driver data that affects tree topology or supported frequencies, etc. They're not found until the clks are actually used by some consumer device driver. New Drivers: - Global, display, gpu, video, camera, tcsr, and rpmh clock controller for the Qualcomm Milos SoC - Camera, display, GPU, and video clock controllers for Qualcomm QCS615 - Video clock controller driver for Qualcomm SM6350 - Camera clock controller driver for Qualcomm SC8180X - I3C clocks and resets on Renesas RZ/G3E - Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/V2H(P) and RZ/V2N - SPI (RSPI) clocks and resets on Renesas RZ/V2H(P) - SDHI and I2C clocks on Renesas RZ/T2H and RZ/N2H - Ethernet clocks and resets on Renesas RZ/G3E - Initial support for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs - Ethernet clocks and resets on Renesas RZ/V2H and RZ/V2N - Timer, I2C, watchdog, GPU, and USB2.0 clocks and resets on Renesas RZ/V2N Updates: - Support atomic PWMs in the PWM clk driver - clk_hw_get_dev() and clk_hw_get_of_node() helpers - Replace round_rate() with determine_rate() in various clk drivers - Convert clk DT bindings to DT schema format for DT validation - Various clk driver cleanups and refactorings from static analysis tools and possibly real humans - A lot of little fixes here and there to things like clk tree topology, missing frequencies, flagging clks as critical, etc" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (216 commits) clk: clocking-wizard: Fix the round rate handling for versal clk: Fix typos clk: spacemit: ccu_pll: fix error return value in recalc_rate callback clk: tegra: periph: Make tegra_clk_periph_ops static clk: tegra: periph: Fix error handling and resolve unsigned compare warning clk: imx: scu: convert from round_rate() to determine_rate() clk: imx: pllv4: convert from round_rate() to determine_rate() clk: imx: pllv3: convert from round_rate() to determine_rate() clk: imx: pllv2: convert from round_rate() to determine_rate() clk: imx: pll14xx: convert from round_rate() to determine_rate() clk: imx: pfd: convert from round_rate() to determine_rate() clk: imx: frac-pll: convert from round_rate() to determine_rate() clk: imx: fracn-gppll: convert from round_rate() to determine_rate() clk: imx: fixup-div: convert from round_rate() to determine_rate() clk: imx: cpu: convert from round_rate() to determine_rate() clk: imx: busy: convert from round_rate() to determine_rate() clk: imx: composite-93: remove round_rate() in favor of determine_rate() clk: imx: composite-8m: remove round_rate() in favor of determine_rate() clk: qcom: Remove redundant pm_runtime_mark_last_busy() calls clk: imx: Remove redundant pm_runtime_mark_last_busy() calls ...

dmaengine: xdmac: make it selectable for ARCH_MICROCHIP

2025-07-23T12:25:32Z

LAN969x uses the Atmel XDMAC, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Link: https://lore.kernel.org/r/20250702183856.1727275-9-robert.marko@sartura.hr Signed-off-by: Vinod Koul

dmaengine: nbpfaxi: Add missing check after DMA map

2025-07-23T12:25:32Z

The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error. Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250707075752.28674-2-fourier.thomas@gmail.com Signed-off-by: Vinod Koul