Re: [PATCH v2 15/23] dmaengine: sdxi: Per-context access key (AKey) table entry allocator

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Uninitialized spinlock access in sdxi_alloc_cxt() error path causing kernel panic.
--

commit 892562ce0135e1869cdd9bddad2a442b66eeef94
Author: Nathan Lynch <nathan.lynch@amd.com>
Subject: dmaengine: sdxi: Per-context access key (AKey) table entry allocator

This commit adds a per-context IDA to keep track of used entries in the
AKey table. It introduces functions to allocate, retrieve the index of,
and free AKey table entries.

> diff --git a/drivers/dma/sdxi/context.c b/drivers/dma/sdxi/context.c
> --- a/drivers/dma/sdxi/context.c
> +++ b/drivers/dma/sdxi/context.c
> @@ -64,6 +65,7 @@ static void sdxi_free_cxt(struct sdxi_cxt *cxt)
>  		dma_free_coherent(sdxi->dev, sq->ring_size,
>  				  sq->desc_ring, sq->ring_dma);
>  	kfree(cxt->sq);
> +	ida_destroy(&cxt->akey_ida);

Will this cause a panic when freeing a partially initialized context?

If sdxi_alloc_cxt() fails allocations internally, it will trigger
sdxi_free_cxt() on the partially initialized context object via the cleanup
macro.

Since akey_ida is initialized in the callers (like sdxi_admin_cxt_init
and sdxi_cxt_new) rather than in sdxi_alloc_cxt() itself, a failure within
sdxi_alloc_cxt() means ida_destroy() will be called on a zero-initialized
structure.

ida_destroy() unconditionally acquires the internal xarray spinlock. Attempting
to lock a zero-initialized spinlock can cause a bad magic splat or kernel
panic.

Could ida_init() be moved inside sdxi_alloc_cxt() to ensure it is always
initialized before any potential cleanup?

>  	kfree(cxt->ring_state);
>  	kfree(cxt);
>  }

[ ... ]

> @@ -322,6 +324,7 @@ int sdxi_admin_cxt_init(struct sdxi_dev *sdxi)
>  	cxt->db = sdxi->dbs + cxt->id * sdxi->db_stride;
>  	sdxi_ring_state_init(cxt->ring_state, &sq->cxt_sts->read_index,
>  			     sq->write_index, sq->ring_entries, sq->desc_ring);
> +	ida_init(&cxt->akey_ida);
>  
>  	err = sdxi_publish_cxt(cxt);
>  	if (err)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260511-sdxi-base-v2-0-889cfed17e3f@amd.com?part=15