Re: [PATCH v1 6/7] gpib: fmh_gpib: Replace dma_request_slave_channel() by dma_request_chan()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] gpib: fmh_gpib: unhandled ERR_PTR from dma_request_chan() causes crash in fmh_gpib_detach()
--

commit 7e5dd98fffd0fbb658150cf070a074a056171a33
Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

gpib: fmh_gpib: Replace dma_request_slave_channel() by dma_request_chan()

This commit replaces the deprecated dma_request_slave_channel() with
dma_request_chan(). It updates the error checking to use PTR_ERR_OR_ZERO()
appropriately for the new function.

> diff --git a/drivers/gpib/fmh_gpib/fmh_gpib.c b/drivers/gpib/fmh_gpib/fmh_gpib.c
> index 5e10e9353fedd..3fdcc673ec8b8 100644
> --- a/drivers/gpib/fmh_gpib/fmh_gpib.c
> +++ b/drivers/gpib/fmh_gpib/fmh_gpib.c
> @@ -1458,10 +1458,11 @@ static int fmh_gpib_attach_impl(struct gpib_board *board, const struct gpib_boar
>  	e_priv->irq = irq;
>  
>  	if (acquire_dma) {
> -		e_priv->dma_channel = dma_request_slave_channel(board->dev, "rxtx");
> -		if (!e_priv->dma_channel) {
> +		e_priv->dma_channel = dma_request_chan(board->dev, "rxtx");
> +		retval = PTR_ERR_OR_ZERO(e_priv->dma_channel);
> +		if (retval) {
>  			dev_err(board->dev, "failed to acquire dma channel \"rxtx\".\n");
> -			return -EIO;
> +			return retval;

[Severity: High]
Does this code leave an ERR_PTR in e_priv->dma_channel on failure?

If dma_request_chan() fails, it returns an error pointer which is stored in
e_priv->dma_channel. When fmh_gpib_attach_impl() returns this error code,
the GPIB core intercepts the attach failure and calls fmh_gpib_detach() to
clean up.

Since fmh_gpib_detach() handles cleanup by checking for NULL:

drivers/gpib/fmh_gpib/fmh_gpib.c:fmh_gpib_detach() {
    ...
    if (e_priv) {
        if (e_priv->dma_channel)
            dma_release_channel(e_priv->dma_channel);
    ...
}

It will evaluate the ERR_PTR as true and attempt to dereference it inside
dma_release_channel(), leading to a kernel oops or panic. Should
e_priv->dma_channel be reset to NULL before returning the error?

>  		}
>  	}
>  	/*

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915100931.3593242-1-andriy.shevchenko@linux.intel.com?part=6