Re: [PATCHv2] dmaengine: bestcomm: ioremap early

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The globally exported `bcom_eng` pointer is freed but not nullified on the probe error path, leaving a dangling pointer.
--

commit c9ef17db56df7b3bc923fc0c2ee2b7acf55e223b
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: bestcomm: ioremap early

This commit replaces the open-coded resource lookup and cleanup in the
bestcomm driver probe and remove paths with the managed
devm_platform_get_and_ioremap_resource() helper, simplifying error handling.

> diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
> index 432b43520ddc9..44ff4a42376b1 100644
> --- a/drivers/dma/bestcomm/bestcomm.c
> +++ b/drivers/dma/bestcomm/bestcomm.c
[ ... ]
> @@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
>  	return 0;
>  
>  	/* Error path */
> -error_unmap:
> -	iounmap(bcom_eng->regs);
> -error_release:
> -	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
>  error_sramclean:
>  	kfree(bcom_eng);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for the global
bcom_eng pointer to be left dangling here?

On the error path when mpc52xx_bcom_probe() fails (e.g., if
bcom_engine_init() returns an error), kfree(bcom_eng) is called but bcom_eng
is not explicitly reset to NULL.

Could local system drivers (like those in drivers/net/ethernet/freescale/)
calling exported functions such as bcom_task_alloc() bypass safety checks
since bcom_eng is not NULL, and proceed to dereference freed memory
(for instance, when attempting to acquire bcom_eng->lock)?

>  	bcom_sram_cleanup();

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902214612.311207-1-rosenp@gmail.com?part=1