Re: [PATCH 3/4] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A race condition exists where shared interrupt handlers can access uninitialized channel structures (like spinlocks and list heads), leading to a kernel crash. The patch fixes one early-IRQ NULL dereference but leaves this secondary crash exposed.
--

commit f0655e3acfc0eee2ccdf6dbee38ba6bad6f04ae5
Author: Koichiro Den <den@valinux.co.jp>

dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

This commit fixes a NULL pointer dereference caused by passing an
uninitialized pointer to request_irq(). It resolves the issue by setting
the back pointer for each IRQ before the handler is installed.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index c2feb3adc79fa..d221e3efcb36b 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c
> @@ -929,7 +929,6 @@ static int dw_edma_channel_setup(struct dw_edma *dw, u32 wr_alloc, u32 rd_alloc)
>  		else
>  			irq->rd_mask |= BIT(chan->id);
>  
> -		irq->dw = dw;

[Severity: High]
This isn't a bug introduced by this patch, but does this sequence still leave
a race condition?

Since dw_edma_irq_request() already registered the shared IRQs before
dw_edma_channel_setup() is called, setting irq->wr_mask or irq->rd_mask
makes the channel visible to the interrupt handler.

If a shared interrupt fires immediately after the mask is updated but
before vchan_init() is called later in this loop:

		if (chan->dir == EDMA_DIR_WRITE)
			irq->wr_mask |= BIT(chan->id);
		...
		vchan_init(&chan->vc, dma);

Could the handler process the channel and call dw_edma_done_interrupt()
or dw_edma_abort_interrupt()?

If so, these functions would attempt to lock the uninitialized
chan->vc.lock and call vchan_next_desc() on the zeroed desc_issued list
head, which may lead to a crash.

>  		memcpy(&chan->msi, &irq->msi, sizeof(chan->msi));
>  
>  		dev_vdbg(dev, "MSI:\t\tChannel %s[%u] addr=0x%.8x%.8x, data=0x%.8x\n",
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260521142153.2957432-1-den@valinux.co.jp?part=3