Re: [PATCH v5 01/12] dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] switchtec_dma_prep_desc() acquires and returns with a spinlock held, violating the dmaengine API and causing inevitable deadlocks.
--

commit 35f30174e5a3e6b3e6f62a9f94873f8da95cfc36
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc()

This commit prevents a double-free in switchtec_dma_free_desc() by setting
hw_sq, hw_cq, and desc_ring entries to NULL after freeing them. This fixes
an issue during channel resource allocation failures where unwind paths
could attempt to free already-released pointers.

> diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c
> index c133535d37656..a10818efba4e5 100644
> --- a/drivers/dma/switchtec_dma.c
> +++ b/drivers/dma/switchtec_dma.c
> @@ -886,14 +886,18 @@ static void switchtec_dma_free_desc(struct switchtec_dma_chan *swdma_chan)
>  	if (swdma_chan->hw_sq)
>  		dma_free_coherent(swdma_dev->dma_dev.dev, size,
>  				  swdma_chan->hw_sq, swdma_chan->dma_addr_sq);
> +	swdma_chan->hw_sq = NULL;
>  
>  	size = SWITCHTEC_DMA_CQ_SIZE * sizeof(*swdma_chan->hw_cq);
[ ... ]

While reviewing this file, I noticed a separate issue in
switchtec_dma_prep_desc():

drivers/dma/switchtec_dma.c:switchtec_dma_prep_desc() {
	spin_lock_bh(&swdma_chan->submit_lock);

	if (!swdma_chan->ring_active)
		goto err_unlock;
	...
	/* return with the lock held, it will be released in tx_submit */

	return &desc->txd;
}

[Severity: High]
This isn't a bug introduced by this patch, but does returning with the
submit_lock held violate the dmaengine API contract and cause deadlocks?

The dmaengine API allows clients to batch multiple descriptor preparations
before submitting them. If a client calls the prep function consecutively,
would the second call attempt to re-acquire the same non-recursive spinlock
and deadlock the CPU?

Additionally, the dmaengine API allows aborting and dropping descriptors
on error before submission. If a prepared descriptor is discarded on a
client error path, would the lock remain permanently held?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831191403.207631-1-logang@deltatee.com?part=1