Re: [PATCH] dmaengine: bestcomm: use devm_platform_get_and_ioremap_resource() to simplify code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling Pointer / Use-After-Free in error path
--

commit fa3bb7a565a9593e1a87078d2bf750faaf572e6d
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: bestcomm: use devm_platform_get_and_ioremap_resource() to simplify code

Replace the open-coded resource lookup, request_mem_region, ioremap and
the manual iounmap/release_mem_region cleanup in probe/remove with the
managed devm_platform_get_and_ioremap_resource() helper. This removes the
now-unused error-unmap/release paths and simplifies probing.

> diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
> index 432b43520ddc9..44ff4a42376b1 100644
> --- a/drivers/dma/bestcomm/bestcomm.c
> +++ b/drivers/dma/bestcomm/bestcomm.c

[ ... ]

> @@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
>  	return 0;
>  
>  	/* Error path */
> -error_unmap:
> -	iounmap(bcom_eng->regs);
> -error_release:
> -	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
>  error_sramclean:
>  	kfree(bcom_eng);

[Severity: High]
This isn't a bug introduced by this patch, but does this error path leave
a dangling pointer?

When mpc52xx_bcom_probe() fails after allocating memory for the globally
visible bcom_eng pointer, it frees the memory but doesn't reset bcom_eng
to NULL.

If probe fails (e.g., during bcom_engine_init()), the global bcom_eng 
will point to freed memory. If dependent drivers load later and call 
functions like bcom_task_alloc(), wouldn't they dereference this dangling
pointer?

>  	bcom_sram_cleanup();
>  error_ofput:
>  	of_node_put(op->dev.of_node);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909232623.89321-1-rosenp@gmail.com?part=1