[PATCH v12 01/20] dmaengine: ti: k3-udma: Fix sporadic crash on AM62x

[Frank Li]

On Wed, Oct 07, 2026 at 03:58:42PM +0530, Sai Sree Kartheek Adivi wrote:
> From: Vignesh Raghavendra <vigneshr at ti.com>
>
> ring_init_data is declared on stack and left uninitialized, so any
> field not explicitly assigned afterwards carries garbage. Every field
> that exists on struct k3_ringacc_init_data today (tisci, tisci_dev_id,
> num_rings) is set immediately below, so this is currently a no-op, but
> a later patch in this series adds a base_rt field to the same struct
> that is not set by this call site. Without this fix, that field would
> carry stack garbage here, and k3_ringacc_dmarings_init() could use a
> junk address for the ringrt base, causing a crash during ring pop:
>
> [    1.998239] cadence-qspi fc40000.spi: couldn't determine phase-detect-selector
> [    2.532106] Unable to handle kernel paging request at virtual address ffff800081a84b98
> [    2.540051] Mem abort info:
> [...]
> [    2.629987] Workqueue: events_unbound deferred_probe_work_func
> [    2.635832] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [    2.642787] pc : k3_ringacc_ring_pop+0x48/0x94
> [    2.647234] lr : udma_pop_from_ring+0x7c/0xb4
> [...]
> [    2.726250] Call trace:
> [    2.728691]  k3_ringacc_ring_pop+0x48/0x94
> [    2.732786]  udma_ring_irq_handler+0x34/0x218
> [    2.737141]  __handle_irq_event_percpu+0x60/0x14c
> [    2.741846]  handle_irq_event+0x4c/0xa8
>
> Fix this proactively by explicitly initializing the variable to 0,
> before the base_rt field is introduced.
>
> Fixes: 017794739702 ("dmaengine: ti: k3-udma: Initial support for K3 BCDMA")
> Signed-off-by: Vignesh Raghavendra <vigneshr at ti.com>
> Signed-off-by: Sai Sree Kartheek Adivi <s-adivi at ti.com>
> ---

Reviewed-by: Frank Li <Frank.Li at nxp.com>

>  drivers/dma/ti/k3-udma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 78a67cb9d6e00..8457644cb9132 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
> @@ -5484,7 +5484,7 @@ static int udma_probe(struct platform_device *pdev)
>  	if (ud->match_data->type == DMA_TYPE_UDMA) {
>  		ud->ringacc = of_k3_ringacc_get_by_phandle(dev->of_node, "ti,ringacc");
>  	} else {
> -		struct k3_ringacc_init_data ring_init_data;
> +		struct k3_ringacc_init_data ring_init_data = { 0 };
>
>  		ring_init_data.tisci = ud->tisci_rm.tisci;
>  		ring_init_data.tisci_dev_id = ud->tisci_rm.tisci_dev_id;
> --
> 2.55.0
>