Re: [PATCH v3 06/13] dmaengine: dw-edma-pcie: Track non-LL mode in DMA data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Calling pci_free_irq_vectors() in remove() violates API guidelines for devices enabled with pcim_enable_device() and leads to a double free.
--

commit 4807e012ff4fafc258bc7806f34cdce5751bf7bf
Author: Koichiro Den <den@valinux.co.jp>
Subject: dmaengine: dw-edma-pcie: Track non-LL mode in DMA data

The dw-edma-pcie driver copies static template data into a mutable
dw_edma_pcie_data instance before applying capability-derived updates. This
commit keeps the derived non-LL mode in that copy as well.

> diff --git a/drivers/dma/dw-edma/dw-edma-pcie.c b/drivers/dma/dw-edma/dw-edma-pcie.c
> index 70ea031147d18..0ea8d59782b44 100644
> --- a/drivers/dma/dw-edma/dw-edma-pcie.c
> +++ b/drivers/dma/dw-edma/dw-edma-pcie.c

[ ... ]

> @@ -326,7 +327,6 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
>  	struct dw_edma_chip *chip;
>  	int err, nr_irqs;
>  	int i, mask;
> -	bool non_ll = false;
>  
>  	if (!pdata)
>  		return -ENODEV;

This is a pre-existing issue, but I noticed a potential problem in how this
driver handles IRQ cleanup.

[Severity: High]
Does dw_edma_pcie_remove() result in a double-free of the IRQ vectors?

This driver calls pcim_enable_device() in dw_edma_pcie_probe(), which marks
the PCI device as managed. Later in the probe function,
pci_alloc_irq_vectors() is called, which automatically registers a devres
action to free the vectors on device detach.

However, dw_edma_pcie_remove() manually calls pci_free_irq_vectors():

drivers/dma/dw-edma/dw-edma-pcie.c:dw_edma_pcie_remove() {
	...
	/* Freeing IRQs */
	pci_free_irq_vectors(pdev);
}

Since the devres action remains registered, will it attempt to free the IRQs
again, causing a double-free on driver unload?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260620170040.3756043-1-den@valinux.co.jp?part=6