Re: [PATCH v3 14/23] dmaengine: sdxi: Attach descriptor ring state to contexts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Driver teardown frees descriptor ring state while threads may be waiting, causing a use-after-free.

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but hardware stalls lead to permanent D-state hangs in `sdxi_ring_reserve`.
--

commit 7d20c79380e3ebc097f2724f0a53221cb5571730
Author: Nathan Lynch <nathan.lynch@amd.com>

dmaengine: sdxi: Attach descriptor ring state to contexts

This commit allocates and attaches a sdxi_ring_state structure to each
sdxi_cxt upon context allocation. The ring state's lifetime is tied to
the context and is freed upon context release.

> diff --git a/drivers/dma/sdxi/context.c b/drivers/dma/sdxi/context.c
> index 2f9a29df5d9ce..907547ac450f2 100644
> --- a/drivers/dma/sdxi/context.c
> +++ b/drivers/dma/sdxi/context.c
[ ... ]
> @@ -63,6 +64,7 @@ static void sdxi_free_cxt(struct sdxi_cxt *cxt)
>  		dma_free_coherent(sdxi->dev, sq->ring_size,
>  				  sq->desc_ring, sq->ring_dma);
>  	kfree(cxt->sq);
> +	kfree(cxt->ring_state);

[Severity: High]
Does this free cause a use-after-free if threads are still waiting in
sdxi_ring_reserve()?

During teardown, contexts may be forcefully exited without stopping DMA
channels or ensuring active users have left. If sdxi_unregister() calls
sdxi_cxt_exit() -> sdxi_free_cxt(), the ring_state struct is freed.

Threads blocked in sdxi_ring_reserve() rely on the wait queue head and lock
inside this freed allocation:

drivers/dma/sdxi/ring.c:sdxi_ring_reserve() {
    wait_event(rs->wqh,
               (ret = sdxi_ring_try_reserve(rs, nr, resv)) != -EBUSY);
}

When a sleeping task is spuriously woken up, it could dereference the freed
rs pointer, leading to memory corruption.

[Severity: High]
This is a pre-existing issue, but can hardware stalls lead to permanent
D-state hangs here?

Looking at sdxi_ring_reserve(), the uninterruptible wait_event() lacks
a timeout and ignores signals:

drivers/dma/sdxi/ring.c:sdxi_ring_reserve() {
    wait_event(rs->wqh,
               (ret = sdxi_ring_try_reserve(rs, nr, resv)) != -EBUSY);
}

If the hardware encounters a fatal error and stops processing descriptors, it
will never increment the read index. Any process attempting to submit a command
will sleep indefinitely.

>  	kfree(cxt);
>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605-sdxi-base-v3-0-4d38ca2bdffe@amd.com?part=14