dmaengine: idxd: fix abort status check

Coverity static analysis of linux-next found issue.

The check (status == IDXD_COMP_DESC_ABORT) is always false since status
was previously masked with 0x7f and IDXD_COMP_DESC_ABORT is 0xff.

Fixes: 6b4b87f2c31a ("dmaengine: idxd: fix submission race window")
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/162698465160.3560828.18173186265683415384.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c
index e018459b534f859f5ff0b768d9645a4a60b021be..65dc7bbb0a137319d97d40904a7c21240ef396d5 100644 (file)
--- a/drivers/dma/idxd/irq.c
+++ b/drivers/dma/idxd/irq.c
@@ -194,7 +194,11 @@ static int irq_process_pending_llist(struct idxd_irq_entry *irq_entry,
                u8 status = desc->completion->status & DSA_COMP_STATUS_MASK;
 
                if (status) {
-                       if (unlikely(status == IDXD_COMP_DESC_ABORT)) {
+                       /*
+                        * Check against the original status as ABORT is software defined
+                        * and 0xff, which DSA_COMP_STATUS_MASK can mask out.
+                        */
+                       if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) {
                                complete_desc(desc, IDXD_COMPLETE_ABORT);
                                (*processed)++;
                                continue;
@@ -250,7 +254,11 @@ static int irq_process_work_list(struct idxd_irq_entry *irq_entry,
        list_for_each_entry(desc, &flist, list) {
                u8 status = desc->completion->status & DSA_COMP_STATUS_MASK;
 
-               if (unlikely(status == IDXD_COMP_DESC_ABORT)) {
+               /*
+                * Check against the original status as ABORT is software defined
+                * and 0xff, which DSA_COMP_STATUS_MASK can mask out.
+                */
+               if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) {
                        complete_desc(desc, IDXD_COMPLETE_ABORT);
                        continue;
                }