Re: [PATCH] dmaengine: at_hdmac: ioremap and get irq early

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to missing tasklet_kill() on driver removal
--

--- Patch [1]: [PATCH] dmaengine: at_hdmac: ioremap and get irq early ---
commit c590e127b59a7e207f5a617b28aad848c06bc09b
Author: Rosen Penev <rosenp@gmail.com>

    dmaengine: at_hdmac: ioremap and get irq early
    
This commit updates the driver to map I/O memory and retrieve the IRQ early
during probe. By performing these operations before allocating memory and
configuring the DMA controller, it avoids unnecessary work if they return
-EPROBE_DEFER.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..2f6f5877fc3cc 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
[ ... ]
> @@ -1968,13 +1977,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
>  	if (!atdma)
>  		return -ENOMEM;
>  
> -	atdma->regs = devm_platform_ioremap_resource(pdev, 0);
> -	if (IS_ERR(atdma->regs))
> -		return PTR_ERR(atdma->regs);
> -
> -	irq = platform_get_irq(pdev, 0);
> -	if (irq < 0)
> -		return irq;
> +	atdma->regs = regs;
>  
>  	/* discover transaction capabilities */
>  	atdma->dma_device.cap_mask = plat_dat->cap_mask;

[Severity: High]
This is a pre-existing issue, but does at_dma_remove() need to call
tasklet_kill() to prevent a use-after-free during driver removal?

If an interrupt fires just before driver removal or device unbind, it can
schedule a channel tasklet via vchan_cookie_complete(), leaving it in the
scheduler queue.

at_dma_remove() cleans up the channels but doesn't kill the tasklets:

drivers/dma/at_hdmac.c:at_dma_remove() {
...
	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
			device_node) {
		/* Disable interrupts */
		atc_disable_chan_irq(atdma, chan->chan_id);
		list_del(&chan->device_node);
	}
...
}

When at_dma_remove() returns, the devres mechanism frees the at_dma
structure containing the tasklet structs.

If a pending tasklet executes on the freed memory, can it cause a
use-after-free and memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050606.283453-1-rosenp@gmail.com?part=1