From 48e989e33b715611438ce4b8d6ff712d4becd84f Mon Sep 17 00:00:00 2001 From: Haotian Zhang Date: Tue, 25 Aug 2026 11:47:59 +0800 Subject: [PATCH] thunderbolt: dma_test: Tear down DMA paths before stopping the rings dma_test_stop_rings() stops the RX and TX rings before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and the cancellation callbacks unmap and free the frame buffers, so by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit any data still in flight has nowhere to drain to; on ASMedia ASM4242-class host routers the bit never clears and every teardown burns the full 500 ms timeout. This is the same defect as the one in tbnet_tear_down(), fixed as CVE-2026-74691 ("net: thunderbolt: Tear down DMA paths before stopping the rings"). Move the tb_xdomain_disable_paths() call before the tb_ring_stop() calls in dma_test_stop_rings(), so in-flight data drains while the rings are still active, and only then stop the rings and free the frame buffers. Signed-off-by: Haotian Zhang Signed-off-by: Mika Westerberg --- drivers/thunderbolt/dma_test.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/thunderbolt/dma_test.c b/drivers/thunderbolt/dma_test.c index 519c67678b08..bcecb0edcb81 100644 --- a/drivers/thunderbolt/dma_test.c +++ b/drivers/thunderbolt/dma_test.c @@ -215,11 +215,6 @@ static void dma_test_stop_rings(struct dma_test *dt) { int ret; - if (dt->rx_ring) - tb_ring_stop(dt->rx_ring); - if (dt->tx_ring) - tb_ring_stop(dt->tx_ring); - ret = tb_xdomain_disable_paths(dt->xd, dt->tx_hopid, dt->tx_ring ? dt->tx_ring->hop : -1, dt->rx_hopid, @@ -227,6 +222,11 @@ static void dma_test_stop_rings(struct dma_test *dt) if (ret) dev_warn(&dt->svc->dev, "failed to disable DMA paths\n"); + if (dt->rx_ring) + tb_ring_stop(dt->rx_ring); + if (dt->tx_ring) + tb_ring_stop(dt->tx_ring); + dma_test_free_rings(dt); }