Re: [PATCHv3 6/6] serial: mxs-auart: terminate DMA before releasing channels in exit

On Wed, Jun 10, 2026 at 08:38:56PM -0700, Rosen Penev wrote:
> mxs_auart_dma_exit_channel() calls dma_release_channel() and then
> kfree() on the DMA buffers without first terminating any in-flight
> transfers. If an asynchronous DMA transfer completes after the buffers
> have been freed, the callback will access freed memory.
>
> Call dmaengine_terminate_sync() on each channel before releasing it
> to safely abort pending transfers.
>
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <[email protected]>
> ---

Reviewed-by: Frank Li <[email protected]>

>  drivers/tty/serial/mxs-auart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
> index fe48a372d022..ec2c60dd0f52 100644
> --- a/drivers/tty/serial/mxs-auart.c
> +++ b/drivers/tty/serial/mxs-auart.c
> @@ -872,10 +872,12 @@ static int mxs_auart_dma_prep_rx(struct mxs_auart_port *s)
>  static void mxs_auart_dma_exit_channel(struct mxs_auart_port *s)
>  {
>  	if (s->tx_dma_chan) {
> +		dmaengine_terminate_sync(s->tx_dma_chan);
>  		dma_release_channel(s->tx_dma_chan);
>  		s->tx_dma_chan = NULL;
>  	}
>  	if (s->rx_dma_chan) {
> +		dmaengine_terminate_sync(s->rx_dma_chan);
>  		dma_release_channel(s->rx_dma_chan);
>  		s->rx_dma_chan = NULL;
>  	}
> --
> 2.54.0
>
>