From 10d34fbca6e09a6a18d64fa3ebaa3db9f27fc1a6 Mon Sep 17 00:00:00 2001 From: Logan Gunthorpe Date: Wed, 2 Sep 2026 00:21:50 -0600 Subject: [PATCH] dmaengine: ioat: disable relaxed ordering before registering the device ioat3_dma_probe() disabled PCIe relaxed ordering after calling dma_async_device_register(), so if an error occurs and the code jumps to err_disable_interrupts, the function returns with the device still registered in the core's dma_device_list while the caller frees the ioatdma_device struct, leaving a dangling registration that anything walking the device list can dereference after it's been freed. Move the capability read/write ahead of dma_async_device_register() instead. Nothing after registration depends on relaxed ordering already being disabled, and nothing before it depends on the device being registered, so this is a plain reordering. It also means every remaining step after registration can't fail, so there's no need to ever have to unregister the device once registered. Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioatdma") Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260707165906.249F41F000E9@smtp.kernel.org Acked-by: Dave Jiang Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe Link: https://lore.kernel.org/dmaengine/20260707165906.249F41F000E9@smtp.kernel.org/T/#u Link: https://patch.msgid.link/20260902062153.31048-9-logang@deltatee.com Signed-off-by: Vinod Koul --- drivers/dma/ioat/init.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 737496391109..a57024c4b066 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat/init.c @@ -1170,15 +1170,6 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); } - err = dma_async_device_register(&ioat_dma->dma_dev); - if (err) - goto err_disable_interrupts; - - ioat_kobject_add(ioat_dma, &ioat_ktype); - - if (dca) - ioat_dma->dca = ioat_dca_init(pdev, ioat_dma->reg_base); - /* disable relaxed ordering */ err = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); if (err) { @@ -1194,6 +1185,15 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) goto err_disable_interrupts; } + err = dma_async_device_register(&ioat_dma->dma_dev); + if (err) + goto err_disable_interrupts; + + ioat_kobject_add(ioat_dma, &ioat_ktype); + + if (dca) + ioat_dma->dca = ioat_dca_init(pdev, ioat_dma->reg_base); + if (ioat_dma->cap & IOAT_CAP_DPS) writeb(ioat_pending_level + 1, ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET);