Re: [PATCH 1/8] dmaengine: ptdma: unmap descriptor before completing cookie

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dmaengine: ptdma: UAF in ae4_pending_work due to unremoved list entries
--

commit 45d9a162336ad9b005d6d181ab13de82d05d7cf3
Author: Wolfram Sang <wsa+renesas@sang-engineering.com>

dmaengine: ptdma: unmap descriptor before completing cookie

To ensure that buffers are flushed, make sure that the descriptor gets
unmapped before completing the cookie.

Link: https://lore.kernel.org/r/20261009093745.539924-1-vkoul@kernel.org

> diff --git a/drivers/dma/amd/ptdma/ptdma-dmaengine.c b/drivers/dma/amd/ptdma/ptdma-dmaengine.c
> index 628c49ce5de9d..7f51d1e6c727f 100644
> --- a/drivers/dma/amd/ptdma/ptdma-dmaengine.c
> +++ b/drivers/dma/amd/ptdma/ptdma-dmaengine.c

[ ... ]

> @@ -362,8 +362,8 @@ static void pt_cmd_callback_work(void *data, int err)
>  		if (desc->status != DMA_ERROR)
>  			desc->status = DMA_COMPLETE;
>  
> -		dma_cookie_complete(tx_desc);
>  		dma_descriptor_unmap(tx_desc);
> +		dma_cookie_complete(tx_desc);

[Severity: High]
Can this result in a use-after-free when pt_terminate_all() is called?

pt_terminate_all() extracts all descriptors from the virt-dma channel and
frees them via vchan_dma_desc_free_list():

drivers/dma/amd/ptdma/ptdma-dmaengine.c:pt_terminate_all() {
    ...
	vchan_dma_desc_free_list(&chan->vc, &head);
    ...
}

However, for AE4 DMA devices, descriptors are additionally added to the
ae4cmd_q->cmd list during pt_create_desc(). pt_terminate_all() fails to
remove the freed descriptors from this hardware pending command list, and
does not acquire ae4cmd_q->cmd_lock.

The asynchronous worker thread ae4_pending_work() then iterates over the
uncleaned list, removes the freed descriptor, and executes its callback:

drivers/dma/amd/ae4dma/ae4dma-dev.c:ae4_pending_work() {
    ...
			cmd = list_first_entry(&ae4cmd_q->cmd, struct pt_cmd, entry);
			list_del(&cmd->entry);

			ae4_check_status_error(ae4cmd_q, ae4cmd_q->dridx);
			cmd->pt_cmd_callback(cmd->data, cmd->ret);
    ...
}

Since pt_cmd_callback_work() is the callback invoked here, will this execution
dereference the freed descriptor pointers and cause list memory corruption?

>  	} else {
>  		tx_desc = NULL;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010124348.19055-1-wsa+renesas@sang-engineering.com?part=1