Re: [PATCH v2 1/5] dmaengine: idxd: assign all engines to group 0 in IAA defaults

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Blind array access to `idxd->wqs[0]` and `idxd->groups[0]` crashes the kernel if the device reports 0 for max workqueues or max groups.
--

--- Patch [1]: [PATCH v2 1/5] dmaengine: idxd: assign all engines to group 0 in IAA defaults ---
commit 209df0dc4b3ef9ed572aa6087272c2bf0872b76a
Author: Giovanni Cabiddu <[email protected]>
Subject: dmaengine: idxd: assign all engines to group 0 in IAA defaults

This commit updates the IAA device defaults to assign all available engines
to group 0. This change ensures that the full hardware parallelism is used
by default without requiring manual accel-config setup.

> diff --git a/drivers/dma/idxd/defaults.c b/drivers/dma/idxd/defaults.c
> index 2bbbcd02a0dac..26ebfa2ca1448 100644
> --- a/drivers/dma/idxd/defaults.c
> +++ b/drivers/dma/idxd/defaults.c
> @@ -8,6 +8,7 @@ int idxd_load_iaa_device_defaults(struct idxd_device *idxd)
>  	struct idxd_engine *engine;
>  	struct idxd_group *group;
>  	struct idxd_wq *wq;
> +	int i;
>  
>  	if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags))
>  		return 0;

[Severity: High]
This is a pre-existing issue, but does idxd_load_iaa_device_defaults()
safely handle devices that report 0 workqueues or groups?

If a malfunctioning device reports 0 for max_wqs or max_groups during probe,
the setup routines will allocate 0-sized arrays. This function later accesses
the first elements without checking the bounds:

idxd_load_iaa_device_defaults()
{
        ...
        wq = idxd->wqs[0];
        ...
        group = idxd->groups[0];
        ...
}

Would this lead to a kernel panic by dereferencing a zero-size pointer
if the device capabilities are malformed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1