Re: [PATCH 5/8] dmaengine: mv_xor_v2: unmap descriptor before completing cookie

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] dmaengine: UAF race from calling dmaengine_desc_get_callback_invoke late
--

commit 8c7213cd37abe1e50d7719fbacf46e143cda1fb6
Author: Wolfram Sang <wsa+renesas@sang-engineering.com>

dmaengine: mv_xor_v2: unmap descriptor before completing cookie

To ensure that buffers are flushed, make sure that the descriptor gets
unmapped before completing the cookie.

Link: https://lore.kernel.org/r/20261009093745.539924-1-vkoul@kernel.org

> diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
> index cad4d4fb51ac3..8a307431721fc 100644
> --- a/drivers/dma/mv_xor_v2.c
> +++ b/drivers/dma/mv_xor_v2.c
> @@ -581,9 +581,8 @@ static void mv_xor_v2_tasklet(struct tasklet_struct *t)
>  			 * lock is required the IMSG threshold provide
>  			 * the locking
>  			 */
> -			dma_cookie_complete(&next_pending_sw_desc->async_tx);
> -
>  			dma_descriptor_unmap(&next_pending_sw_desc->async_tx);
> +			dma_cookie_complete(&next_pending_sw_desc->async_tx);
>  			dmaengine_desc_get_callback_invoke(
>  					&next_pending_sw_desc->async_tx, NULL);
>  		}

[Severity: High]
Does completing the cookie before extracting the callback information create a
use-after-free race condition?

dma_cookie_complete() updates tx->chan->completed_cookie, which makes the DMA
transaction completion visible to clients polling via dma_async_is_tx_complete().

After completion is signaled, clients are legally allowed to free the callback
context (callback_param), recycle resources, or even unload the module
containing the callback function.

If a polling client races and frees the resources immediately after seeing
completion, the subsequent call to dmaengine_desc_get_callback_invoke() could
dereference a freed callback_param or jump to unmapped module memory.

Should the callback information be cached using dmaengine_desc_get_callback()
before calling dma_cookie_complete(), and then invoked via
dmaengine_desc_callback_invoke() afterwards?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010124348.19055-1-wsa+renesas@sang-engineering.com?part=5