Re: [PATCH v5 04/17] s390/dasd: Use GFP_KERNEL in dasd_alloc_device()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing timer synchronization in teardown allows the device timeout handler to run concurrently with or after the device is freed.
--

--- Patch [4]: [PATCH v5 04/17] s390/dasd: Use GFP_KERNEL in dasd_alloc_device() ---
commit 476054dc9b8482264c4038c62c8c82f3d75106b4
Author: Stefan Haberland <[email protected]>

s390/dasd: Use GFP_KERNEL in dasd_alloc_device()

This commit changes the allocation flags in dasd_alloc_device() from
GFP_ATOMIC to GFP_KERNEL. Since the function runs in process context,
using GFP_KERNEL is more reliable for large DMA allocations.

> diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
> --- a/drivers/s390/block/dasd.c
> +++ b/drivers/s390/block/dasd.c
> @@ -86,25 +86,25 @@ struct dasd_device *dasd_alloc_device(void)
>  {
>  	struct dasd_device *device;
>  
> -	device = kzalloc_obj(struct dasd_device, GFP_ATOMIC);
> +	device = kzalloc_obj(struct dasd_device, GFP_KERNEL);
>  	if (!device)
>  		return ERR_PTR(-ENOMEM);

[Severity: High]
This is a pre-existing issue, but does the device teardown path lack timer
synchronization for this allocated device?

During teardown, dasd_device_clear_timer() calls non-synchronous
timer_delete():

void dasd_device_clear_timer(struct dasd_device *device)
{
        timer_delete(&device->timer);
}

Because this does not wait for a concurrently executing timer handler on
another CPU, and the timer does not acquire a reference on the device when
armed, could dasd_delete_device() complete its wait for the reference count
and free the device while dasd_device_timeout() is still running?

If dasd_device_timeout() executes on another CPU and accesses the device:

        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);

Could this result in a use-after-free of the device and its associated
structures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4