A partial DMA mapping failure can leave per-transfer mapping flags set
while cur_{tx,rx}_dma_dev are NULL or still refer to the devices used
for an earlier message. The subsequent cleanup may then unmap a
transfer with a NULL or stale device.
Before commit e289df82344f ("spi: Rework per message DMA mapped flag to
be per transfer"), partial-failure handling was already incomplete, but
__spi_unmap_msg() was gated by cur_msg_mapped, which was set only after
the whole message mapped successfully. Earlier mappings could leak, but
cleanup could not unmap them with an unpublished device. The
per-transfer conversion removed that gate: mapping flags can now remain
set while cur_{tx,rx}_dma_dev are still unpublished, turning the leak
into a NULL- or stale-device unmap regression.
Patch 1 publishes the mapping devices before the loop and unwinds every
failure through __spi_unmap_msg(). It keeps the forward declaration so
it is independently buildable and straightforward to backport. Patch 2
then removes the declaration by moving __spi_unmap_msg() above
__spi_map_msg(). Patch 3 clears the current DMA device pointers once the
message has been unmapped, while leaving them intact during partial-map
unwind and DMA-to-PIO fallback. Patch 4 adds the DMA mapping KUnit suite
as a separate translation unit.
Only patch 1 is a stable candidate; patches 2 through 4 are follow-up
cleanup and test changes for mainline.
Testing:
- Patch 1 builds independently with the x86_64 reproducer configuration.
- The spi_dma KUnit suite passes all four cases on x86_64 and UML.
Moving the DMA device assignments back after the mapping loop makes
both failure-path cases fail.
- The default and all-tests KUnit configurations both select the suite.
- All four reproducer cases complete without an oops when run as the
first message, and map/unmap counts are balanced after a successful
first message.
- After message cleanup, cur_{tx,rx}_dma_dev are NULL.
Changes in v2:
- Explain why e289df82344f changed the partial-failure mode.
- Use plain if (ret) checks in the mapping loop.
- Add separate follow-up patches for the helper relocation and clearing
stale DMA device pointers.
- Build the KUnit tests as a separate translation unit through the local
internal header and <kunit/visibility.h>.
- Rename the Kconfig symbol and suite namespace for the DMA subsuite,
and rename the test file to spi-dma-kunit.c.
- Enable SPI in the default and all-tests KUnit configurations.
v1: https://lore.kernel.org/r/[email protected]
Honghui Jiang (4):
spi: Fix DMA mapping ownership on partial map failure
spi: Move __spi_unmap_msg() before __spi_map_msg()
spi: Clear current DMA devices when unmapping a message
spi: Add KUnit coverage for DMA mapping error paths
drivers/spi/.kunitconfig | 4 +
drivers/spi/Kconfig | 13 +
drivers/spi/Makefile | 1 +
drivers/spi/internals.h | 9 +-
drivers/spi/spi.c | 91 ++++---
drivers/spi/tests/Makefile | 3 +
drivers/spi/tests/spi-dma-kunit.c | 259 +++++++++++++++++++
tools/testing/kunit/configs/all_tests.config | 1 +
tools/testing/kunit/configs/default.config | 1 +
9 files changed, 340 insertions(+), 42 deletions(-)
create mode 100644 drivers/spi/.kunitconfig
create mode 100644 drivers/spi/tests/Makefile
create mode 100644 drivers/spi/tests/spi-dma-kunit.c
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
--
2.43.0
