[PATCH] dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()

[Vinod Koul]

On Tue, 16 Dec 2025 22:10:06 +0800, Guodong Xu wrote:
> Add proper locking in mmp_pdma_residue() to prevent use-after-free when
> accessing descriptor list and descriptor contents.
> 
> The race occurs when multiple threads call tx_status() while the tasklet
> on another CPU is freeing completed descriptors:
> 
> CPU 0                              CPU 1
> -----                              -----
> mmp_pdma_tx_status()
> mmp_pdma_residue()
>   -> NO LOCK held
>      list_for_each_entry(sw, ..)
>                                    DMA interrupt
>                                    dma_do_tasklet()
>                                      -> spin_lock(&desc_lock)
>                                         list_move(sw->node, ...)
>                                         spin_unlock(&desc_lock)
>   |                                     dma_pool_free(sw) <- FREED!
>   -> access sw->desc <- UAF!
> 
> [...]

Applied, thanks!

[1/1] dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
      commit: a143545855bc2c6e1330f6f57ae375ac44af00a7

Best regards,
-- 
~Vinod