Re: [PATCH v3 10/23] dmaengine: sdxi: Complete administrative context jump start

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing explicit device stop/reset on probe failure leads to DMA use-after-free
--

commit 416e2a783d5f21c412d3a7e804c33d0f978dad21
Author: Nathan Lynch <nathan.lynch@amd.com>

dmaengine: sdxi: Complete administrative context jump start

This commit introduces a helper to push the administrative context
doorbell. It then updates the device activation sequence to start
the admin context by pushing this doorbell after the device becomes
active.

> diff --git a/drivers/dma/sdxi/device.c b/drivers/dma/sdxi/device.c
> index e8f087f758fde..b875d8cdb58af 100644
> --- a/drivers/dma/sdxi/device.c
> +++ b/drivers/dma/sdxi/device.c
> @@ -269,7 +269,20 @@ static int sdxi_fn_activate(struct sdxi_dev *sdxi)
>  	 * SDXI 1.0 4.1.8.9: Set MMIO_CTL0.fn_gsr to GSRV_ACTIVE and
>  	 * wait for MMIO_STS0.fn_gsv to reach GSV_ACTIVE or GSV_ERROR.
>  	 */
> -	return sdxi_dev_start(sdxi);
> +	err = sdxi_dev_start(sdxi);
> +	if (err)
> +		return err;

[Severity: High]
This is a pre-existing issue, but does this error path in sdxi_fn_activate()
leave the hardware active while its DMA-mapped structures are freed?

If sdxi_dev_start() fails during initialization, such as by timing out while
waiting for the device to transition to the active state, the function
returns an error and the device probe fails.

The devres framework then executes cleanup actions in reverse order of their
registration. This causes devres to free the DMA-coherent memory allocated
for the L1/L2 tables and the admin context before it invokes the PCI cleanup
that calls pcim_disable_device() to stop bus mastering.

During this window, the hardware device has been commanded to become active
and retains the pointers to the now-freed DMA memory. If the device completes
its transition and performs any DMA operations, could it corrupt freed kernel
memory and lead to a DMA use-after-free?

Should the device be explicitly commanded to stop or reset in the error
handling path before returning?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605-sdxi-base-v3-0-4d38ca2bdffe@amd.com?part=10