Re: [PATCH v3 15/23] dmaengine: sdxi: Per-context access key (AKey) table entry allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling `ida_destroy()` on an uninitialized `struct ida` during error cleanup will cause a 'spinlock bad magic' BUG/panic.
--

commit bae483227e10a5de8c4656d9cc0ae199cc275f05
Author: Nathan Lynch <nathan.lynch@amd.com>

dmaengine: sdxi: Per-context access key (AKey) table entry allocator

Each SDXI context has a table of access keys (AKeys). SDXI descriptors
submitted to a context may refer to an AKey associated with that
context by its index in the table.

> diff --git a/drivers/dma/sdxi/context.c b/drivers/dma/sdxi/context.c
> index 907547ac450f2..9b0984842d9a7 100644
> --- a/drivers/dma/sdxi/context.c
> +++ b/drivers/dma/sdxi/context.c
> @@ -64,6 +65,7 @@ static void sdxi_free_cxt(struct sdxi_cxt *cxt)
>  		dma_free_coherent(sdxi->dev, sq->ring_size,
>  				  sq->desc_ring, sq->ring_dma);
>  	kfree(cxt->sq);
> +	ida_destroy(&cxt->akey_ida);

[Severity: High]
Will this trigger a spinlock bad magic BUG during error cleanup?

If sdxi_alloc_cxt() fails during its memory allocations:

drivers/dma/sdxi/context.c:sdxi_alloc_cxt() {
    struct sdxi_cxt *cxt __free(sdxi_cxt) = kzalloc(sizeof(*cxt), GFP_KERNEL);
    ...
    return NULL;
}

The __free(sdxi_cxt) cleanup handler automatically calls sdxi_free_cxt().

Because ida_init(&cxt->akey_ida) is only called later by external callers
like sdxi_admin_cxt_init() or sdxi_cxt_new(), the ida remains uninitialized
on these early error paths.

Calling ida_destroy() unconditionally here will try to acquire the
uninitialized XArray spinlock with xas_lock_irqsave(), which crashes the
kernel.

[ ... ]

> @@ -322,6 +324,7 @@ int sdxi_admin_cxt_init(struct sdxi_dev *sdxi)
>  	cxt->db = sdxi->dbs + cxt->id * sdxi->db_stride;
>  	sdxi_ring_state_init(cxt->ring_state, &sq->cxt_sts->read_index,
>  			     sq->write_index, sq->ring_entries, sq->desc_ring);
> +	ida_init(&cxt->akey_ida);
>  
>  	err = sdxi_publish_cxt(cxt);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605-sdxi-base-v3-0-4d38ca2bdffe@amd.com?part=15