[PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path

[PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path

[Chen Changcheng]

In ep93xx_pata_dma_init() error path, when dma_request_chan() for the tx
channel fails, the code jumps to fail_release_rx which releases the rx
channel via dma_release_channel() and then falls through to
fail_release_dma, which calls ep93xx_pata_release_dma(). This causes a
double-free of dma_rx_channel. Additionally, drv_data->dma_tx_channel
holds an ERR_PTR at this point, so ep93xx_pata_release_dma() would also
attempt to dma_release_channel() on it.

Fix by removing the fail_release_rx label and jumping directly to
fail_release_dma instead. Make ep93xx_pata_release_dma() use
IS_ERR_OR_NULL() so that it safely handles channels that may be
ERR_PTR rather than valid pointers.

Fixes: 9963113e3a92 ("ata: pata_ep93xx: add device tree support")
Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
---
 drivers/ata/pata_ep93xx.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 42a24dc51d26..b4fb89481b7e 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -629,11 +629,11 @@ static int ep93xx_pata_bus_softreset(struct ata_port *ap, unsigned int devmask,
 
 static void ep93xx_pata_release_dma(struct ep93xx_pata_data *drv_data)
 {
-	if (drv_data->dma_rx_channel) {
+	if (!IS_ERR_OR_NULL(drv_data->dma_rx_channel)) {
 		dma_release_channel(drv_data->dma_rx_channel);
 		drv_data->dma_rx_channel = NULL;
 	}
-	if (drv_data->dma_tx_channel) {
+	if (!IS_ERR_OR_NULL(drv_data->dma_tx_channel)) {
 		dma_release_channel(drv_data->dma_tx_channel);
 		drv_data->dma_tx_channel = NULL;
 	}
@@ -664,7 +664,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	if (IS_ERR(drv_data->dma_tx_channel)) {
 		ret = dev_err_probe(dev, PTR_ERR(drv_data->dma_tx_channel),
 				    "tx DMA setup failed\n");
-		goto fail_release_rx;
+		goto fail_release_dma;
 	}
 
 	/* Configure receive channel direction and source address */
@@ -691,8 +691,6 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 
 	return 0;
 
-fail_release_rx:
-	dma_release_channel(drv_data->dma_rx_channel);
 fail_release_dma:
 	ep93xx_pata_release_dma(drv_data);
 
-- 
2.25.1

Re: [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Probe fails entirely instead of falling back to PIO mode when DMA channels are not available.
--

--- Patch [1]: [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path ---
commit 5d77ddcea9fce813ec9dad68a5d5fe3f97dacb61
Author: Chen Changcheng <chenchangcheng@kylinos.cn>

ata: pata_ep93xx: fix double-free of DMA channel on error path

This commit fixes a double-free of the rx DMA channel and a potential invalid
release of an ERR_PTR tx channel in the ep93xx_pata_dma_init() error path.
It achieves this by updating ep93xx_pata_release_dma() to safely check using
IS_ERR_OR_NULL() and adjusting the error jump labels.

> diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
> index 42a24dc51d26b..b4fb89481b7ee 100644
> --- a/drivers/ata/pata_ep93xx.c
> +++ b/drivers/ata/pata_ep93xx.c
[ ... ]
> @@ -664,7 +664,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
>  	if (IS_ERR(drv_data->dma_tx_channel)) {
>  		ret = dev_err_probe(dev, PTR_ERR(drv_data->dma_tx_channel),
>  				    "tx DMA setup failed\n");
> -		goto fail_release_rx;
> +		goto fail_release_dma;

[Severity: High]
This is a pre-existing issue, but does this error path prevent the driver
from falling back to PIO mode?

In ep93xx_pata_probe(), the driver aborts entirely if ep93xx_pata_dma_init()
returns an error:

ep93xx_pata_probe() {
    ...
    err = ep93xx_pata_dma_init(drv_data);
    if (err)
        return err;
    ...
}

If dma_request_chan() returns an error (like -ENODEV when DMA is not
configured in the Device Tree), the error is propagated via dev_err_probe().

Would it be better to treat missing DMA channels as a soft failure so the
device can still initialize and operate in PIO mode?

>  	}
>  
>  	/* Configure receive channel direction and source address */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708092704.60815-1-chenchangcheng@kylinos.cn?part=1

Re: [PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path

[Arnd Bergmann]

On Wed, Jul 8, 2026, at 11:27, Chen Changcheng wrote:
>  static void ep93xx_pata_release_dma(struct ep93xx_pata_data *drv_data)
>  {
> -	if (drv_data->dma_rx_channel) {
> +	if (!IS_ERR_OR_NULL(drv_data->dma_rx_channel)) {
>  		dma_release_channel(drv_data->dma_rx_channel);
>  		drv_data->dma_rx_channel = NULL;
>  	}

If something requires you to use IS_ERR_OR_NULL(), that is usually
a bad API design, and you should fix this at the place where
it gets introduced.

Please fix the probe path instead so it doesn't try to use the
device without a valid channel.

      Arnd