linux-kernel - [PATCH] dmaengine: sh: rcar-dmac: Add missing dma_descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251027004634.562749-1-den@valinux.co.jp>
Date: Mon, 27 Oct 2025 09:46:34 +0900
From: Koichiro Den <den@...inux.co.jp>
To: dmaengine@...r.kernel.org,
	linux-renesas-soc@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: vkoul@...nel.org,
	geert+renesas@...der.be,
	magnus.damm@...il.com,
	kuninori.morimoto.gx@...esas.com
Subject: [PATCH] dmaengine: sh: rcar-dmac: Add missing dma_descriptor_unmap()

Call dma_descriptor_unmap() right after dma_cookie_complete() in the
threaded IRQ completion path. Without this, streaming DMA mappings
attached to the descriptor are never released and may eventually exhaust
DMA mapping resources (e.g. IOVA with an IOMMU or bounce-buffer slots
with SWIOTLB), leading to dma_map_* failures.

Also ensure dma_descriptor_unmap() is called in rcar_dmac_chan_reinit()
(error/terminate path) to avoid the same type of leaks.

Signed-off-by: Koichiro Den <den@...inux.co.jp>
---
 drivers/dma/sh/rcar-dmac.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 0c45ce8c74aa..c30f64180d9f 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -842,6 +842,7 @@ static void rcar_dmac_chan_reinit(struct rcar_dmac_chan *chan)
 
 	list_for_each_entry_safe(desc, _desc, &descs, node) {
 		list_del(&desc->node);
+		dma_descriptor_unmap(&desc->async_tx);
 		rcar_dmac_desc_put(chan, desc);
 	}
 }
@@ -1652,6 +1653,7 @@ static irqreturn_t rcar_dmac_isr_channel_thread(int irq, void *dev)
 		desc = list_first_entry(&chan->desc.done, struct rcar_dmac_desc,
 					node);
 		dma_cookie_complete(&desc->async_tx);
+		dma_descriptor_unmap(&desc->async_tx);
 		list_del(&desc->node);
 
 		dmaengine_desc_get_callback(&desc->async_tx, &cb);
-- 
2.48.1