Re: [PATCH v5 05/12] dmaengine: switchtec-dma: fix channel leak on registration failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uninitialized list head iteration in ISR causing NULL pointer dereference.
--

commit bbb6888bb23afe2e2ce4a0388779ab6fa86e4ce3
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: switchtec-dma: fix channel leak on registration failure

This patch introduces a helper function to free DMA channel memory and ensures
it is called correctly during registration failures and cleanup. It also updates
the channel count on initialization failure to allow safe cleanup of partially
allocated channels.

Link: https://lore.kernel.org/dmaengine/20260717223024.9BB8A1F000E9@smtp.kernel.org
Link: https://lore.kernel.org/dmaengine/20260727190604.397DB1F000E9@smtp.kernel.org

> diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c
> index 2d5ba194c99a1..f71c64c137e83 100644
> --- a/drivers/dma/switchtec_dma.c
> +++ b/drivers/dma/switchtec_dma.c
[ ... ]
> @@ -1329,6 +1335,7 @@ static int switchtec_dma_create(struct pci_dev *pdev)
>  
>  err_chans_release_exit:
>  	switchtec_dma_chans_release(pdev, swdma_dev);
> +	switchtec_dma_chans_free(swdma_dev);
>  
>  err_exit:
>  	if (swdma_dev->chan_status_irq)

[Severity: High]
This is a pre-existing issue, but I noticed a potential race condition
during device initialization earlier in switchtec_dma_create().

The IRQ is requested and enabled before the channels list head is
initialized:

drivers/dma/switchtec_dma.c:switchtec_dma_create() {
	...
	rc = pci_request_irq(pdev, irq, NULL, switchtec_dma_chan_status_isr,
			     swdma_dev, KBUILD_MODNAME);
	...
	chan_cnt = switchtec_dma_chans_enumerate(swdma_dev, pdev, chan_cnt);
	...
}

If a pending device interrupt or a spurious interrupt fires immediately
after pci_request_irq() is called, switchtec_dma_chan_status_isr() will
execute.

In the ISR, list_for_each_entry() iterates over dma_dev->channels:

drivers/dma/switchtec_dma.c:switchtec_dma_chan_status_isr() {
	...
	list_for_each_entry(chan, &dma_dev->channels, device_node) {
	...
}

Since switchtec_dma_chans_enumerate() hasn't called INIT_LIST_HEAD()
on dma_dev->channels yet, the list head remains zero-initialized by
the earlier kzalloc().

Could this cause a NULL pointer dereference when the ISR attempts to
iterate over the uninitialized list?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831191403.207631-1-logang@deltatee.com?part=5