Re: [PATCH v3 08/23] dmaengine: sdxi: Install administrative context

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing device stop on probe error path leads to hardware DMA use-after-free.
--

commit 982a4ee81c07402d7c367dae3f394c267f1ffedd
Author: Nathan Lynch <nathan.lynch@amd.com>

dmaengine: sdxi: Install administrative context
    
Serialize the context control block, akey table, and L1 entry for the
admin context, making its descriptor ring, write index, and context
status block visible to the SDXI implementation once it is activated.

> diff --git a/drivers/dma/sdxi/context.c b/drivers/dma/sdxi/context.c
> index 443c231303aff..cc99fe9ecf928 100644
> --- a/drivers/dma/sdxi/context.c
> +++ b/drivers/dma/sdxi/context.c

[ ... ]

[Severity: High]
Could this regression occur where the error path returns a timeout without
stopping the hardware that was just commanded to start?

drivers/dma/sdxi/device.c:sdxi_dev_start() {
...
	ret = sdxi_dev_gsv_poll(sdxi, status,
				status == SDXI_GSV_ACTIVE ||
				status == SDXI_GSV_ERROR);
	if (ret) {
		dev_err(sdxi->dev, "activation timed out, current state: %s\n",
			gsv_str(status));
		return ret;
	}
...
}

During probe, sdxi_fn_activate() commands the hardware to transition to the
ACTIVE state by writing SDXI_GSRV_ACTIVE in sdxi_dev_start(), and then polls
for it. If this polling times out, sdxi_dev_start() returns -ETIMEDOUT and
the device probe fails:

drivers/dma/sdxi/device.c:sdxi_fn_activate() {
...
	err = sdxi_dev_start(sdxi);
	if (err)
		return err;
...
}

However, the driver does not invoke sdxi_dev_stop() on this error path, nor
does it register a devres action to stop the hardware on teardown. As devres
unwinds the probe failure, it frees the DMA memory for the L1 table,
L2 table, and admin context.

Because the hardware was commanded to start and never stopped, could it
transition to ACTIVE asynchronously after the timeout and access the freed
DMA memory, resulting in IOMMU faults or memory corruption?

Should sdxi_dev_stop() be explicitly called on the error path, or registered
as a devm action?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605-sdxi-base-v3-0-4d38ca2bdffe@amd.com?part=8