From: sashiko-bot@kernel.org
To: "Chen Changcheng" <chenchangcheng@kylinos.cn>
Cc: linux-ide@vger.kernel.org, dlemoal@kernel.org, cassel@kernel.org
Subject: Re: [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path
Date: Wed, 08 Jul 2026 09:35:16 +0000 [thread overview]
Message-ID: <20260708093516.829931F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260708092704.60815-1-chenchangcheng@kylinos.cn>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Probe fails entirely instead of falling back to PIO mode when DMA channels are not available.
--
--- Patch [1]: [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path ---
commit 5d77ddcea9fce813ec9dad68a5d5fe3f97dacb61
Author: Chen Changcheng <chenchangcheng@kylinos.cn>
ata: pata_ep93xx: fix double-free of DMA channel on error path
This commit fixes a double-free of the rx DMA channel and a potential invalid
release of an ERR_PTR tx channel in the ep93xx_pata_dma_init() error path.
It achieves this by updating ep93xx_pata_release_dma() to safely check using
IS_ERR_OR_NULL() and adjusting the error jump labels.
> diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
> index 42a24dc51d26b..b4fb89481b7ee 100644
> --- a/drivers/ata/pata_ep93xx.c
> +++ b/drivers/ata/pata_ep93xx.c
[ ... ]
> @@ -664,7 +664,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
> if (IS_ERR(drv_data->dma_tx_channel)) {
> ret = dev_err_probe(dev, PTR_ERR(drv_data->dma_tx_channel),
> "tx DMA setup failed\n");
> - goto fail_release_rx;
> + goto fail_release_dma;
[Severity: High]
This is a pre-existing issue, but does this error path prevent the driver
from falling back to PIO mode?
In ep93xx_pata_probe(), the driver aborts entirely if ep93xx_pata_dma_init()
returns an error:
ep93xx_pata_probe() {
...
err = ep93xx_pata_dma_init(drv_data);
if (err)
return err;
...
}
If dma_request_chan() returns an error (like -ENODEV when DMA is not
configured in the Device Tree), the error is propagated via dev_err_probe().
Would it be better to treat missing DMA channels as a soft failure so the
device can still initialize and operate in PIO mode?
> }
>
> /* Configure receive channel direction and source address */
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260708092704.60815-1-chenchangcheng@kylinos.cn?part=1
next prev parent reply other threads:[~2026-07-08 9:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-08 9:27 [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path Chen Changcheng
2026-07-08 9:35 ` sashiko-bot [this message]
2026-07-08 10:50 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260708093516.829931F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=cassel@kernel.org \
--cc=chenchangcheng@kylinos.cn \
--cc=dlemoal@kernel.org \
--cc=linux-ide@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.