Re: [PATCH v6 02/18] dmaengine: sh: rz-dmac: Fix incorrect NULL check for list_first_entry()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Premature early return in `rz_dmac_chan_get_residue()` incorrectly reports pending transfers as complete.
--

commit fea7825b62a6663b4eee5a60ada5a7e2123e0506
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

dmaengine: sh: rz-dmac: Fix incorrect NULL check for list_first_entry()

This commit replaces list_first_entry() with list_first_entry_or_null() in
rz_dmac_chan_get_residue() to fix an invalid NULL check. It addresses the fact
that list_first_entry() does not return NULL when a list is empty.

> diff --git a/drivers/dma/sh/rz-dmac.c b/drivers/dma/sh/rz-dmac.c
> index 9f206a33dcc6b..6d80cb668957f 100644
> --- a/drivers/dma/sh/rz-dmac.c
> +++ b/drivers/dma/sh/rz-dmac.c
> @@ -723,8 +723,8 @@ static u32 rz_dmac_chan_get_residue(struct rz_dmac_chan *channel,
>  	u32 crla, crtb, i;
>  
>  	/* Get current processing virtual descriptor */
> -	current_desc = list_first_entry(&channel->ld_active,
> -					struct rz_dmac_desc, node);
> +	current_desc = list_first_entry_or_null(&channel->ld_active,
> +						struct rz_dmac_desc, node);
>  	if (!current_desc)
>  		return 0;

[Severity: High]
Does returning 0 here prematurely report pending transfers as complete?

When ld_active is empty, such as for a transfer that has been prepared and
queued but not yet started by the hardware, list_first_entry_or_null()
returns NULL, causing an immediate return of 0.

Before this patch, list_first_entry() on an empty list evaluated to a non-NULL
pointer, allowing the code to bypass this early return and successfully fall
back to checking ld_queue to find the pending descriptor.

By returning 0 early here, rz_dmac_tx_status() will override the transfer
status to DMA_COMPLETE since the residue is 0. Will this cause a DMA client
to falsely assume memory has been transferred before the hardware begins the
operation?

Note that this issue appears to be fixed later in the series by commit
d09437d0a9b5a ("dmaengine: sh: rz-dmac: Use virt-dma APIs for channel
descriptor processing"), which refactors descriptor tracking.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260526084710.3491480-1-claudiu.beznea@kernel.org?part=2