On 10/13/26 22:23, [email protected] wrote:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
to consider:
- [High] nvme: missing controller state check allows attaching DMA-BUF to dead
PCI device
--
commit 6741fe43dc1132ae4f51db272567ac5b56987f17
Author: Pavel Begunkov <[email protected]>
nvme-pci: implement dma-buf backed requests
This patch implements DMA-BUF backed requests for the NVMe PCI driver. It
allows mapping DMA-BUFs on registration and storing them as a PRP list to
initialize requests. Attached contexts are tracked in a new list
synchronized with a lock.
diff --git a/drivers/nvme/host/pci-dmabuf.c b/drivers/nvme/host/pci-dmabuf.c
new file mode 100644
index 0000000000000..8dab59d936507
--- /dev/null
+++ b/drivers/nvme/host/pci-dmabuf.c
[ ... ]
+static int nvme_init_io_ctx_locked(struct nvme_ctrl *ctrl,
+ struct nvme_dma_buf_list *buf_list,
+ struct dma_buf_io_ctx *ctx)
+{
+ struct nvme_dma_buf_io_ctx *nvme_ctx;
+ struct dma_buf_attachment *attach;
+
+ nvme_ctx = kzalloc_obj(*nvme_ctx);
+ if (!nvme_ctx)
+ return -ENOMEM;
+
+ attach = dma_buf_dynamic_attach(ctx->dmabuf, ctrl->dev,
+ &nvme_dmabuf_importer_ops, ctx);
[Severity: High]
Does this code allow attaching a DMA-BUF to a tearing-down or dead PCI device?
If the PCI device is hot-unplugged or its driver is unbound, nvme_remove()
calls nvme_dev_disable() which cleans up existing DMA-BUF contexts via
nvme_pci_remove_dmabuf().
Looks legit. Going to send a v11.
--
Pavel Begunkov
