[PATCH] dmaengine: at_hdmac: ioremap and get irq early

[PATCH] dmaengine: at_hdmac: ioremap and get irq early

[Rosen Penev]

The functions can return -EPROBE_DEFER. Call them before anything else
to avoid doing extra work.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/at_hdmac.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index e5b30a57c477..2f6f5877fc3c 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1943,11 +1943,20 @@ static void at_dma_off(struct at_dma *atdma)
 static int __init at_dma_probe(struct platform_device *pdev)
 {
 	struct at_dma		*atdma;
+	void __iomem		*regs;
 	int			irq;
 	int			err;
 	int			i;
 	const struct at_dma_platform_data *plat_dat;
 
+	regs = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(regs))
+		return PTR_ERR(regs);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
+
 	/* setup platform data for each SoC */
 	dma_cap_set(DMA_MEMCPY, at91sam9rl_config.cap_mask);
 	dma_cap_set(DMA_INTERLEAVE, at91sam9g45_config.cap_mask);
@@ -1968,13 +1977,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
 	if (!atdma)
 		return -ENOMEM;
 
-	atdma->regs = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(atdma->regs))
-		return PTR_ERR(atdma->regs);
-
-	irq = platform_get_irq(pdev, 0);
-	if (irq < 0)
-		return irq;
+	atdma->regs = regs;
 
 	/* discover transaction capabilities */
 	atdma->dma_device.cap_mask = plat_dat->cap_mask;
-- 
2.55.0

Re: [PATCH] dmaengine: at_hdmac: ioremap and get irq early

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to missing tasklet_kill() on driver removal
--

--- Patch [1]: [PATCH] dmaengine: at_hdmac: ioremap and get irq early ---
commit c590e127b59a7e207f5a617b28aad848c06bc09b
Author: Rosen Penev <rosenp@gmail.com>

    dmaengine: at_hdmac: ioremap and get irq early
    
This commit updates the driver to map I/O memory and retrieve the IRQ early
during probe. By performing these operations before allocating memory and
configuring the DMA controller, it avoids unnecessary work if they return
-EPROBE_DEFER.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..2f6f5877fc3cc 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
[ ... ]
> @@ -1968,13 +1977,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
>  	if (!atdma)
>  		return -ENOMEM;
>  
> -	atdma->regs = devm_platform_ioremap_resource(pdev, 0);
> -	if (IS_ERR(atdma->regs))
> -		return PTR_ERR(atdma->regs);
> -
> -	irq = platform_get_irq(pdev, 0);
> -	if (irq < 0)
> -		return irq;
> +	atdma->regs = regs;
>  
>  	/* discover transaction capabilities */
>  	atdma->dma_device.cap_mask = plat_dat->cap_mask;

[Severity: High]
This is a pre-existing issue, but does at_dma_remove() need to call
tasklet_kill() to prevent a use-after-free during driver removal?

If an interrupt fires just before driver removal or device unbind, it can
schedule a channel tasklet via vchan_cookie_complete(), leaving it in the
scheduler queue.

at_dma_remove() cleans up the channels but doesn't kill the tasklets:

drivers/dma/at_hdmac.c:at_dma_remove() {
...
	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
			device_node) {
		/* Disable interrupts */
		atc_disable_chan_irq(atdma, chan->chan_id);
		list_del(&chan->device_node);
	}
...
}

When at_dma_remove() returns, the devres mechanism frees the at_dma
structure containing the tasklet structs.

If a pending tasklet executes on the freed memory, can it cause a
use-after-free and memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050606.283453-1-rosenp@gmail.com?part=1