Re: [PATCH v2 27/64] dmaengine: k3dma: kill vchan BH on remove

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Concurrent execution of `k3_dma_tasklet` and `k3_dma_remove` leads to list corruption and a `LIST_POISON1` kernel panic.
--

--- Patch [27]: [PATCH v2 27/64] dmaengine: k3dma: kill vchan BH on remove ---
commit 0a41ab53724cb23d95bb02f7dd926541fc428dd1
Author: Allen Pais <allen.lkml@gmail.com>

dmaengine: k3dma: kill vchan BH on remove

This commit updates virt-dma cleanup in the k3dma driver. It switches from
using tasklet_kill() to dma_chan_kill_bh() during driver removal, reflecting
that vchan now uses the per-channel BH helper.

> diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c
> index e84f197fea76f..99a70b90a02b1 100644
> --- a/drivers/dma/k3dma.c
> +++ b/drivers/dma/k3dma.c
> @@ -976,7 +976,7 @@ static void k3_dma_remove(struct platform_device *op)
>  
>  	list_for_each_entry_safe(c, cn, &d->slave.channels, vc.chan.device_node) {
>  		list_del(&c->vc.chan.device_node);

[Severity: High]
This is a pre-existing issue, but can this sequence cause a list corruption and
kernel panic if a hardware tasklet runs concurrently?

If an interrupt fires and schedules d->task just before devm_free_irq() runs,
k3_dma_tasklet() could run concurrently and iterate over d->slave.channels
locklessly:

drivers/dma/k3dma.c:k3_dma_tasklet() {
    ...
    list_for_each_entry_safe(c, cn, &d->slave.channels, vc.chan.device_node) {
        spin_lock_irq(&c->vc.lock);
        p = c->phy;
    ...
}

Concurrently, k3_dma_remove() calls list_del() on the channel nodes before
calling tasklet_kill(&d->task) below. If k3_dma_tasklet() fetches a deleted
node, will it see LIST_POISON1 in the next pointer and panic on the next
iteration?

Could tasklet_kill(&d->task) be moved before the channel list modification to
ensure the tasklet is stopped first?

> -		tasklet_kill(&c->vc.task);
> +		dma_chan_kill_bh(&c->vc.chan);
>  	}
>  	tasklet_kill(&d->task);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785183549.git.allen.lkml@gmail.com?part=27