Re: [PATCH] dmaengine: idxd: Remove channel from list on registration failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe lockless modification of `dma->channels` and missing `dma_list_mutex` lock leading to global list corruption.
--

--- Patch [1]: [PATCH] dmaengine: idxd: Remove channel from list on registration failure ---
commit 4fb2c9798431d41ef3638a29b584b02b54cf00cf
Author: Ruoyu Wang <ruoyuw560@gmail.com>

dmaengine: idxd: Remove channel from list on registration failure

This commit fixes a stale list entry bug by removing the channel from the
dma channels list before freeing it on the registration failure path.

> diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
> --- a/drivers/dma/idxd/dma.c
> +++ b/drivers/dma/idxd/dma.c
> @@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
>  
>  	rc = dma_async_device_channel_register(dma, chan, NULL);
>  	if (rc < 0) {
> +		list_del(&chan->device_node);

[Severity: High]
This is a pre-existing issue, but does this list_del() and the surrounding
code need additional locking to safely modify the channel list?

Currently, idxd_register_dma_channel() modifies the shared dma->channels
list while only holding a per-workqueue lock, rather than a lock that
serializes access to the parent dma device.

Furthermore, this path calls dma_async_device_channel_register() which
leads to a lockless global list traversal:

idxd_register_dma_channel()
  dma_async_device_channel_register()
    dma_channel_rebalance()

The dma_channel_rebalance() function requires the caller to hold the global
dma_list_mutex, but dma_async_device_channel_register() does not acquire it.

If a privileged user triggers concurrent sysfs bind operations on multiple
idxd workqueue devices, could they race here and corrupt both the global
dma_device_list and the shared dma->channels list?

>  		kfree(idxd_chan);
>  		return rc;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709062303.4167624-1-ruoyuw560@gmail.com?part=1