[PATCH] dmaengine: idxd: Remove channel from list on registration failure

[PATCH] dmaengine: idxd: Remove channel from list on registration failure

[Ruoyu Wang]

idxd_register_dma_channel() links the channel before registering it.
If dma_async_device_channel_register() fails after that, the error path
frees idxd_chan while chan->device_node remains on dma->channels.

The DMA device can therefore retain a channel list entry that points into
freed idxd_chan memory. Remove the channel from dma->channels before
freeing idxd_chan on the registration failure path, matching the driver's
normal unregister path.

A static analysis checker reported the stale list entry, and manual
source review confirmed the registration failure path.

Fixes: 397862855619 ("dmaengine: idxd: fix dma device lifetime")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/dma/idxd/dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
index 9937b671f6376..f2c03f3cf1925 100644
--- a/drivers/dma/idxd/dma.c
+++ b/drivers/dma/idxd/dma.c
@@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
 
 	rc = dma_async_device_channel_register(dma, chan, NULL);
 	if (rc < 0) {
+		list_del(&chan->device_node);
 		kfree(idxd_chan);
 		return rc;
 	}
-- 
2.51.0

Re: [PATCH] dmaengine: idxd: Remove channel from list on registration failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe lockless modification of `dma->channels` and missing `dma_list_mutex` lock leading to global list corruption.
--

--- Patch [1]: [PATCH] dmaengine: idxd: Remove channel from list on registration failure ---
commit 4fb2c9798431d41ef3638a29b584b02b54cf00cf
Author: Ruoyu Wang <ruoyuw560@gmail.com>

dmaengine: idxd: Remove channel from list on registration failure

This commit fixes a stale list entry bug by removing the channel from the
dma channels list before freeing it on the registration failure path.

> diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
> --- a/drivers/dma/idxd/dma.c
> +++ b/drivers/dma/idxd/dma.c
> @@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
>  
>  	rc = dma_async_device_channel_register(dma, chan, NULL);
>  	if (rc < 0) {
> +		list_del(&chan->device_node);

[Severity: High]
This is a pre-existing issue, but does this list_del() and the surrounding
code need additional locking to safely modify the channel list?

Currently, idxd_register_dma_channel() modifies the shared dma->channels
list while only holding a per-workqueue lock, rather than a lock that
serializes access to the parent dma device.

Furthermore, this path calls dma_async_device_channel_register() which
leads to a lockless global list traversal:

idxd_register_dma_channel()
  dma_async_device_channel_register()
    dma_channel_rebalance()

The dma_channel_rebalance() function requires the caller to hold the global
dma_list_mutex, but dma_async_device_channel_register() does not acquire it.

If a privileged user triggers concurrent sysfs bind operations on multiple
idxd workqueue devices, could they race here and corrupt both the global
dma_device_list and the shared dma->channels list?

>  		kfree(idxd_chan);
>  		return rc;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709062303.4167624-1-ruoyuw560@gmail.com?part=1

Re: [PATCH] dmaengine: idxd: Remove channel from list on registration failure

[Dave Jiang]

On 7/8/26 11:23 PM, Ruoyu Wang wrote:
> idxd_register_dma_channel() links the channel before registering it.
> If dma_async_device_channel_register() fails after that, the error path
> frees idxd_chan while chan->device_node remains on dma->channels.
> 
> The DMA device can therefore retain a channel list entry that points into
> freed idxd_chan memory. Remove the channel from dma->channels before
> freeing idxd_chan on the registration failure path, matching the driver's
> normal unregister path.
> 
> A static analysis checker reported the stale list entry, and manual
> source review confirmed the registration failure path.
> 
> Fixes: 397862855619 ("dmaengine: idxd: fix dma device lifetime")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/dma/idxd/dma.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
> index 9937b671f6376..f2c03f3cf1925 100644
> --- a/drivers/dma/idxd/dma.c
> +++ b/drivers/dma/idxd/dma.c
> @@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
>  
>  	rc = dma_async_device_channel_register(dma, chan, NULL);
>  	if (rc < 0) {
> +		list_del(&chan->device_node);
>  		kfree(idxd_chan);
>  		return rc;
>  	}