thunderbolt: dma_test: Tear down DMA paths before stopping the rings

dma_test_stop_rings() stops the RX and TX rings before calling
tb_xdomain_disable_paths().  tb_ring_stop() zeroes the ring's descriptor
base and the cancellation callbacks unmap and free the frame buffers, so
by the time __tb_path_deactivate_hop() polls the hop's 'pending' bit any
data still in flight has nowhere to drain to; on ASMedia ASM4242-class
host routers the bit never clears and every teardown burns the full
500 ms timeout.  This is the same defect as the one in tbnet_tear_down(),
fixed as CVE-2026-74691 ("net: thunderbolt: Tear down DMA paths before
stopping the rings").

Move the tb_xdomain_disable_paths() call before the tb_ring_stop() calls
in dma_test_stop_rings(), so in-flight data drains while the rings are
still active, and only then stop the rings and free the frame buffers.

Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>

0 files changed, 0 insertions, 0 deletions