Re: [PATCH v1] dmaengine: cirrus: Drop left-over from platform probing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The platform driver lacks a `.remove` callback to unregister the DMA device and OF controller, leading to resource leaks and Use-After-Free on driver unbind.
--

commit 844ada15c68c774c951ecb59e9621ff3d60b26db
Author: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>

dmaengine: cirrus: Drop left-over from platform probing

This commit drops the traditional platform device ID table from the ep93xx
DMA driver. Since the driver was previously converted to use Device Tree for
probing, the id_table is obsolete and can be removed.

> diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c
> index 8eceb96d058c9..a3395cfcf5dd5 100644
> --- a/drivers/dma/ep93xx_dma.c
> +++ b/drivers/dma/ep93xx_dma.c
[ ... ]
> @@ -1587,18 +1587,11 @@ static const struct of_device_id ep93xx_dma_of_ids[] = {
>  };
>  MODULE_DEVICE_TABLE(of, ep93xx_dma_of_ids);
>  
> -static const struct platform_device_id ep93xx_dma_driver_ids[] = {
> -	{ "ep93xx-dma-m2p", 0 },
> -	{ "ep93xx-dma-m2m", 1 },
> -	{ },
> -};
> -
>  static struct platform_driver ep93xx_dma_driver = {
>  	.driver		= {
>  		.name	= "ep93xx-dma",
>  		.of_match_table = ep93xx_dma_of_ids,
>  	},
> -	.id_table	= ep93xx_dma_driver_ids,
>  	.probe		= ep93xx_dma_probe,
>  };

[Severity: High]
This is a pre-existing issue, but does this platform driver need a .remove
callback to prevent resource leaks and use-after-free conditions on unbind?

In ep93xx_dma_probe(), the driver registers the DMA engine and OF controller:

    dma_async_device_register(&edmac->dma_dev);
    of_dma_controller_register(pdev->dev.of_node, ep93xx_dma_of_xlate, edmac);

The edmac context structure is allocated via devm_kzalloc(). Since there is
no .remove callback, dma_async_device_unregister() and
of_dma_controller_free() are never called.

When the driver is unbound, devres automatically frees the memory, leaving
the DMA and OF core subsystems with dangling pointers. Would adding a
.remove callback resolve this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/c3830cb95b0bb939f9cc9543dfa3047e41532c47.1779976024.git.ukleinek@kernel.org?part=1