dmaengine: fsl_raid: don't invoke client callback under desc_lock

drivers/dma/fsl_raid.c static void fsl_re_dequeue(struct tasklet_struct *t) · line 205

[Severity: High]
This is a pre-existing issue, but does fsl_re_desc_done() signal completion too early?

Looking at fsl_re_desc_done(), it marks the DMA cookie complete before unmapping the memory:

drivers/dma/fsl_raid.c:fsl_re_desc_done() {
	dma_cookie_complete(&desc->async_tx);
	dma_descriptor_unmap(&desc->async_tx);
	dmaengine_desc_get_callback_invoke(&desc->async_tx, NULL);
}

If a client polling for completion observes the complete cookie on another CPU, could it access the destination buffer before the cache invalidation or bounce buffer sync completes?

drivers/dma/fsl_raid.c static void fsl_re_dequeue(struct tasklet_struct *t) · line 210

[Severity: High]
This is a pre-existing issue, but can fsl_re_free_chan_resources() crash if the free_q empties prematurely?

When a client releases a channel with pending or unacknowledged descriptors, the loop executes alloc_count times without checking if the list is empty:

drivers/dma/fsl_raid.c:fsl_re_free_chan_resources() {
	...
	while (re_chan->alloc_count--) {
		desc = list_first_entry(&re_chan->free_q,
					struct fsl_re_desc,
					node);
	...
}

Does this result in an invalid pointer dereference and list corruption when list_first_entry() returns the list head itself?

[Severity: High]
This is a pre-existing issue, but does driver removal risk a use-after-free if a DMA client is still active?

During unbind, fsl_re_remove() destroys the channel rings before unregistering the DMA device:

drivers/dma/fsl_raid.c:fsl_re_remove() {
	...
	for (i = 0; i < re_priv->total_chans; i++)
		fsl_re_remove_chan(re_priv->re_jrs[i]);

	/* Unregister the driver */
	dma_async_device_unregister(&re_priv->dma_dev);
	...
}

If a client issues pending requests in this window, could fsl_re_issue_pending() copy descriptor structures into the freed ring buffer?

[Severity: High]
This is a pre-existing issue, but does this driver miss endianness conversions on hardware structures?

Both fill_cfd_frame() and fsl_re_init_desc() directly assign native CPU variables to __be32 hardware fields:

drivers/dma/fsl_raid.c:fill_cfd_frame() {
	...
	cf[index].efrl32 = efrl;
	cf[index].addr_high = upper_32_bits(addr);
	cf[index].addr_low = lower_32_bits(addr);
	...
}

drivers/dma/fsl_raid.c:fsl_re_init_desc() {
	...
	desc->hwdesc.lbea32 = upper_32_bits(paddr);
	desc->hwdesc.addr_low = lower_32_bits(paddr);
	...
}

Will this cause hardware faults or silent data corruption when executed on a Little-Endian architecture?

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1