Re: [PATCH v2 2/2] spi: fsl-lpspi: fix missing RX DMA termination on TX prepare failure

[Frank Li]

On Wed, May 20, 2026 at 05:43:08PM +0800, Carlos Song (OSS) wrote:
> From: Carlos Song <carlos.song@xxxxxxx>
>
> When dmaengine_prep_slave_sg() fails for the TX channel, the error path
> only terminates the TX DMA channel but leaves the RX channel running.
> Since the RX channel was already submitted and issued prior to preparing
> the TX descriptor, returning -EINVAL causes the SPI core to unmap the
> DMA buffers while the RX DMA engine continues writing to them, leading
> to potential memory corruption or use-after-free.
>
> Fix this by also terminating the RX channel before returning on the TX
> prepare failure path.
>
> Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Carlos Song <carlos.song@xxxxxxx>
> ---
> change for v2:
>   - Add fix missing RX DMA termination on TX prepare failure.
> ---
>  drivers/spi/spi-fsl-lpspi.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
> index 1a94a42fac31..906892453a84 100644
> --- a/drivers/spi/spi-fsl-lpspi.c
> +++ b/drivers/spi/spi-fsl-lpspi.c
> @@ -647,6 +647,7 @@ static int fsl_lpspi_dma_transfer(struct spi_controller *controller,
>  				tx->sgl, tx->nents, DMA_MEM_TO_DEV,
>  				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
>  	if (!desc_tx) {
> +		dmaengine_terminate_sync(controller->dma_rx);
>  		dmaengine_terminate_sync(controller->dma_tx);

Are you sure need terminate tx ? suppose tx have not submitted yet because
failure to prep.

I think it's should be typo previously, you intent temerate dma_rx insteand
dma_tx at beginning.

Frank
>  		return -EINVAL;
>  	}
> --
> 2.43.0
>