Re: [PATCH 04/10] dmaengine: fsldma: convert to devm_kzalloc and fix error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The DMA device object is freed before its reference count reaches zero during unbind, causing a Use-After-Free.
--

commit bb63aa80e614c90735ef23a9a63a8a58c655050a
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: fsldma: convert to devm_kzalloc and fix error path

Convert fdev allocation from kzalloc_obj to devm_kzalloc to simplify
the probe error and remove paths by dropping the explicit kfree.

> diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
> index 0d28f8299bf88..2efa16d12679a 100644
> --- a/drivers/dma/fsldma.c
> +++ b/drivers/dma/fsldma.c
> @@ -1213,18 +1213,17 @@ static void fsl_dma_chan_remove(struct fsldma_chan *chan)
>  
>  static int fsldma_of_probe(struct platform_device *op)
>  {
> +	struct device *dev = &op->dev;
>  	struct fsldma_device *fdev;

[ ... ]

> @@ -1335,7 +1330,6 @@ static void fsldma_of_remove(struct platform_device *op)
>  	}
>  
>  	iounmap(fdev->regs);
> -	kfree(fdev);
>  }

[Severity: High]
This isn't a bug introduced by this patch, but does relying on devres to
free the fdev structure leave the driver vulnerable to a use-after-free
during device unbind?

The DMA framework uses a reference count (fdev->common.ref) to track the
lifetime of the dma_device structure and requires drivers to provide a
device_release callback to free it only when the count drops to zero.

Since this driver does not provide a device_release callback, devres will
free the fdev memory synchronously immediately after fsldma_of_remove()
completes. If a DMA client still holds a reference to a channel when the
device is unbound via sysfs, the core framework will eventually drop its
reference and access the freed fdev memory, triggering a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605220134.43295-1-rosenp@gmail.com?part=4