Patch "dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dmaengine-altera-msgdma-properly-free-descriptor-in-.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2a734922d83617714ae795965752c4595da2eb2b
Author: Olivier Dautricourt <olivierdautricourt@xxxxxxxxx>
Date:   Sat Jun 8 23:31:48 2024 +0200

    dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
    
    [ Upstream commit 54e4ada1a4206f878e345ae01cf37347d803d1b1 ]
    
    Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
    of msgdma_free_descriptor. In consequence replace list_add_tail with
    list_move_tail in msgdma_free_descriptor.
    
    This fixes the path:
       msgdma_free_chan_resources -> msgdma_free_descriptors ->
       msgdma_free_desc_list -> msgdma_free_descriptor
    
    which does not correctly free the descriptors as first nodes were not
    removed from the list.
    
    Signed-off-by: Olivier Dautricourt <olivierdautricourt@xxxxxxxxx>
    Tested-by: Olivier Dautricourt <olivierdautricourt@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240608213216.25087-3-olivierdautricourt@xxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma/altera-msgdma.c b/drivers/dma/altera-msgdma.c
index 160a465b06dd..041f549c8c99 100644
--- a/drivers/dma/altera-msgdma.c
+++ b/drivers/dma/altera-msgdma.c
@@ -233,7 +233,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,
 	struct msgdma_sw_desc *child, *next;
 
 	mdev->desc_free_cnt++;
-	list_add_tail(&desc->node, &mdev->free_list);
+	list_move_tail(&desc->node, &mdev->free_list);
 	list_for_each_entry_safe(child, next, &desc->tx_list, node) {
 		mdev->desc_free_cnt++;
 		list_move_tail(&child->node, &mdev->free_list);
@@ -588,8 +588,6 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)
 	list_for_each_entry_safe(desc, next, &mdev->done_list, node) {
 		struct dmaengine_desc_callback cb;
 
-		list_del(&desc->node);
-
 		dmaengine_desc_get_callback(&desc->async_tx, &cb);
 		if (dmaengine_desc_callback_valid(&cb)) {
 			spin_unlock_irqrestore(&mdev->lock, irqflags);