* [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
@ 2026-01-06 3:24 Tuo Li
2026-01-06 15:37 ` Dave Jiang
2026-03-09 11:41 ` Vinod Koul
0 siblings, 2 replies; 3+ messages in thread
From: Tuo Li @ 2026-01-06 3:24 UTC (permalink / raw)
To: vinicius.gomes, dave.jiang, vkoul; +Cc: dmaengine, linux-kernel, Tuo Li
At the end of this function, d is the traversal cursor of flist, but the
code completes found instead. This can lead to issues such as NULL pointer
dereferences, double completion, or descriptor leaks.
Fix this by completing d instead of found in the final
list_for_each_entry_safe() loop.
Fixes: aa8d18becc0c ("dmaengine: idxd: add callback support for iaa crypto")
Signed-off-by: Tuo Li <islituo@gmail.com>
---
drivers/dma/idxd/submit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
index 6db1c5fcedc5..03217041b8b3 100644
--- a/drivers/dma/idxd/submit.c
+++ b/drivers/dma/idxd/submit.c
@@ -138,7 +138,7 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
*/
list_for_each_entry_safe(d, t, &flist, list) {
list_del_init(&d->list);
- idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, true,
+ idxd_dma_complete_txd(d, IDXD_COMPLETE_ABORT, true,
NULL, NULL);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
2026-01-06 3:24 [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() Tuo Li
@ 2026-01-06 15:37 ` Dave Jiang
2026-03-09 11:41 ` Vinod Koul
1 sibling, 0 replies; 3+ messages in thread
From: Dave Jiang @ 2026-01-06 15:37 UTC (permalink / raw)
To: Tuo Li, vinicius.gomes, vkoul; +Cc: dmaengine, linux-kernel
On 1/5/26 8:24 PM, Tuo Li wrote:
> At the end of this function, d is the traversal cursor of flist, but the
> code completes found instead. This can lead to issues such as NULL pointer
> dereferences, double completion, or descriptor leaks.
>
> Fix this by completing d instead of found in the final
> list_for_each_entry_safe() loop.
>
> Fixes: aa8d18becc0c ("dmaengine: idxd: add callback support for iaa crypto")
> Signed-off-by: Tuo Li <islituo@gmail.com>
Good catch! Thanks.
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> ---
> drivers/dma/idxd/submit.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
> index 6db1c5fcedc5..03217041b8b3 100644
> --- a/drivers/dma/idxd/submit.c
> +++ b/drivers/dma/idxd/submit.c
> @@ -138,7 +138,7 @@ static void llist_abort_desc(struct idxd_wq *wq, struct idxd_irq_entry *ie,
> */
> list_for_each_entry_safe(d, t, &flist, list) {
> list_del_init(&d->list);
> - idxd_dma_complete_txd(found, IDXD_COMPLETE_ABORT, true,
> + idxd_dma_complete_txd(d, IDXD_COMPLETE_ABORT, true,
> NULL, NULL);
> }
> }
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
2026-01-06 3:24 [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() Tuo Li
2026-01-06 15:37 ` Dave Jiang
@ 2026-03-09 11:41 ` Vinod Koul
1 sibling, 0 replies; 3+ messages in thread
From: Vinod Koul @ 2026-03-09 11:41 UTC (permalink / raw)
To: vinicius.gomes, dave.jiang, Tuo Li; +Cc: dmaengine, linux-kernel
On Tue, 06 Jan 2026 11:24:28 +0800, Tuo Li wrote:
> At the end of this function, d is the traversal cursor of flist, but the
> code completes found instead. This can lead to issues such as NULL pointer
> dereferences, double completion, or descriptor leaks.
>
> Fix this by completing d instead of found in the final
> list_for_each_entry_safe() loop.
>
> [...]
Applied, thanks!
[1/1] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
commit: e1c9866173c5f8521f2d0768547a01508cb9ff27
Best regards,
--
~Vinod
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-09 11:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-06 3:24 [PATCH] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() Tuo Li
2026-01-06 15:37 ` Dave Jiang
2026-03-09 11:41 ` Vinod Koul
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox