Re: [PATCH 4/4] dmaengine: dmatest: Optionally make test errors fatal

On 7/22/2026 11:33 AM, [email protected] wrote:
>> +/*
>> + * Record a test error whose details were just logged via result(). When
>> + * fatal_errors is set, panic once that many errors have accumulated in the
>> + * current run.
>> + */
>> +static void dmatest_note_error(struct dmatest_info *info)
>> +{
>> +     unsigned int errors;
>> +
>> +     if (!info->params.fatal_errors)
>> +             return;
>> +
>> +     errors = atomic_inc_return(&info->error_count);
>> +     if (errors >= info->params.fatal_errors)
>> +             panic("dmatest: fatal_errors=%u and %u error(s) encountered\n",
>> +                   info->params.fatal_errors, errors);
> 
> [Severity: High]
> Can a concurrent modification of the fatal_errors parameter cause a spurious
> kernel panic here?
> 
> If a user modifies the fatal_errors parameter to 0 (meaning 'never panic') via
> sysfs while test threads are executing, info->params.fatal_errors could be
> concurrently overwritten with 0 via add_threaded_test().
> 
> If this happens between the initial check and the second read:
> 
> CPU1 in dmatest_note_error()
>     if (!info->params.fatal_errors) // reads > 0
>         return;
> 
>     errors = atomic_inc_return(&info->error_count); // acts as a barrier
> 
> CPU2 modifying sysfs
>     info->params.fatal_errors = 0;

No I don't think writing to the module parameters in sysfs immediately
updates the parameters of a running test. The module parameters are
propagated to the test parameter block only in add_threaded_test(). I
think this is a false positive.
> 
> CPU1 in dmatest_note_error()
>     if (errors >= info->params.fatal_errors) // reads 0
> 
> Will the condition errors >= 0 evaluate to true and inadvertently trigger the
> panic? Could we read info->params.fatal_errors into a local variable once to
> prevent this race?
> 
>> +}
> 
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260722-dmatest-fixes-and-fatal-errors-v1-0-8287709987ea@amd.com?part=4