Re: [PATCH RFC 09/20] ctlv: Prepare VA blob handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ctlv: infinite loop in ctlv_blob_context_finish() on task mismatch
--

commit f68d871d01d9258f8b2e576464f1c447eac3313e
Author: Jiri Pirko <jiri@resnulli.us>

ctlv: Prepare VA blob handling

Add task-bound VA blob resolution and CPU read/write access for CTLV
families. The blob object can be compile-checked individually.

> diff --git a/drivers/ctlv/blob.c b/drivers/ctlv/blob.c
> new file mode 100644
> index 0000000000000..2c93da62b2010
> --- /dev/null
> +++ b/drivers/ctlv/blob.c

[ ... ]

> +int ctlv_blob_context_finish(struct ctlv_op_ctx *ctx)
> +{
> +	ctx->blobs_live = false;
> +	if (WARN_ON_ONCE(!list_empty(&ctx->blobs)) && !ctx->blob_error)
> +		ctx->blob_error = -EINVAL;
> +	while (!list_empty(&ctx->blobs)) {
> +		struct ctlv_blob *blob = list_first_entry(&ctx->blobs, struct ctlv_blob, entry);
> +
> +		ctlv_blob_put(blob);
> +	}
> +	return ctx->blob_error;
> +}

[Severity: High]
Does this loop risk a hard lockup if ctlv_blob_context_finish() runs from a
task context different from the submitter?

If the contexts do not match, ctlv_blob_put() evaluates
WARN_ON_ONCE(!ctlv_blob_same_task(blob)) and returns -EINVAL early, bypassing
the list_del(&blob->entry) cleanup:

drivers/ctlv/blob.c:ctlv_blob_put() {
    ...
	if (WARN_ON_ONCE(!ctlv_blob_same_task(blob)))
		return -EINVAL;
    ...
	if (blob->ctx) {
		list_del(&blob->entry);
		blob->ctx = NULL;
	}
    ...
}

Because the return value of ctlv_blob_put() is ignored in this loop and the
blob is never removed from the list, the list remains non-empty. This will
cause the loop to continuously pop the exact same blob and fail repeatedly,
resulting in an infinite loop.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015145053.3664509-1-jiri@resnulli.us?part=9