ub: udma: free the tp active buffers with kfree() instead of kfree_rcu() · Pull Request !1138 · OpenCloudOS/OpenCloudOS-Kernel

## Problem

`udma_ctrlq_check_tp_status()` and `udma_ctrlq_check_tp_active()` each declare a
two-member helper struct **on the stack** — a pointer plus a `struct rcu_head` —
and then pass its address to `kfree_rcu()`. The grace period callback therefore
calls `kfree()` on a stack address, which is not a slab object, and the buffers
that were actually allocated — the request copy in
`udma_ctrlq_check_tp_status()` and the response buffer built by it — are never
freed at all.

The handlers run when the management software sends `UDMA_CMD_CTRLQ_CHECK_TP_ACTIVE`
over the control queue, so this is on a normal firmware-initiated path, not a
test-only one.

## Fix

The message payload is consumed synchronously: `ubase_ctrlq_send_msg()` copies
`msg->in` into the ctrlq ring (or to IO memory for the command queue) before it
returns, and this handler passes `need_resp = 0`, so nothing refers to either
buffer afterwards.

Drop the stack helper structs: keep the allocated request copy in a plain
pointer and release both buffers with `kfree()`, including on the allocation
failure path. The response pointer is also initialised to `NULL`, so a failed
parameter check now leaves `msg.in` and `msg.in_size` consistent.

## Verification

- `scripts/checkpatch.pl --no-signoff --strict`: 0 errors, 0 warnings.
- arm64 build (`CONFIG_UB=y`, `CONFIG_UB_UBUS`, `CONFIG_UB_UBUS_BUS`, `CONFIG_UB_UBUS_USI`, `CONFIG_UB_UMMU_CORE`, `CONFIG_UB_UBASE=y`, `CONFIG_UB_URMA=m`, `CONFIG_UB_UDMA=m`, target `drivers/ub/urma/hw/udma/`, Bootlin aarch64 gcc 15.3.0, `W=1`): baseline and patched trees both build with exit 0 and produce all 19 objects; both show the same single pre-existing `-Wunused-but-set-variable` warning in `udma_jfc.c`, which is not touched here.
- Not run: runtime test. No UB hardware is available in the development environment, so the firmware-initiated handler could not be exercised.

类型	指派人员	状态
审查	zoucao Huang Cun Jianping Liu	已完成 (0/0人)
测试	Jianping Liu	已完成 (0/0人)

GVPOpenCloudOS / OpenCloudOS-Kernel

搜索帮助

GVP OpenCloudOS / OpenCloudOS-Kernel