[PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path

[PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path

[Hongling Zeng]

When request_irq() succeeds but a later error occurs in at_dma_probe(),
the error handling path attempts to free the IRQ by calling
platform_get_irq() again instead of using the already stored IRQ number
in the local variable 'irq'.

Use the stored 'irq' variable directly in free_irq() to make the
code clearer and eliminate smatch warnings about potential IRQ leaks.

While platform_get_irq() is deterministic, using the stored value
makes the error handling more robust against future code changes and
clearly shows the relationship between request_irq() and free_irq().

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>

---
 Change in v2:
 -Add pre-review
---
 drivers/dma/at_hdmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 09b1aedefb45..48b92043881a 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -2125,7 +2125,7 @@ static int __init at_dma_probe(struct platform_device *pdev)
 err_memset_pool_create:
 	dma_pool_destroy(atdma->lli_pool);
 err_desc_pool_create:
-	free_irq(platform_get_irq(pdev, 0), atdma);
+	free_irq(irq, atdma);
 err_irq:
 	clk_disable_unprepare(atdma->clk);
 	return err;
-- 
2.25.1

Re: [PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing tasklet_kill() in the device remove path can lead to Use-After-Free if the device is forcibly unbound.
--

--- Patch [1]: [PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path ---
commit a2d04416b94efa75bbae4e7c156c0d75fc20608a
Author: Hongling Zeng <zenghongling@kylinos.cn>

dma: at_hdmac: Use stored IRQ in error path

When request_irq() succeeds but a later error occurs in at_dma_probe(),
the error handling path attempts to free the IRQ by calling
platform_get_irq() again. This commit updates the error handling path
to use the previously stored irq variable instead, clarifying the code
and resolving warnings.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..2a860679b9e1c 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c

[ ... ]

This is a pre-existing issue, but while reviewing the IRQ and teardown
changes in this file, I noticed a potential problem in at_dma_remove():

drivers/dma/at_hdmac.c:at_dma_remove() {
    ...
	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
			device_node) {
		/* Disable interrupts */
		atc_disable_chan_irq(atdma, chan->chan_id);
		list_del(&chan->device_node);
	}
    ...
}

[Severity: High]
Does this code miss a call to tasklet_kill() for the virtual DMA tasklet?

If a device unbind occurs while a DMA transaction is active, and the DMA
interrupt fires just before free_irq() is called in at_dma_remove(), the
interrupt handler will schedule the virtual DMA tasklet.

Since tasklet_kill() is not called to cancel pending tasklets before
returning, the tasklet remains queued on the CPU softirq list. Once
at_dma_remove() completes and the devres subsystem automatically frees
the atdma memory structure, the tasklet will subsequently execute and
access the freed virt_dma_chan memory. Can this lead to a Use-After-Free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727062917.46905-1-zenghongling@kylinos.cn?part=1