Re: [PATCH 05/10] dmaengine: fsldma: convert ioremap to devm_platform_ioremap_resource

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Medium] Commit message inaccurately claims to remove the 'out_return' label.

Pre-existing issues:
- [High] Missing IRQ cleanup in probe error path leads to resource leak and Use-After-Free.
--

commit 377d9333b3cd60b40444ff2c8de7a2822f91747a
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: fsldma: convert ioremap to devm_platform_ioremap_resource

This patch converts of_iomap() to devm_platform_ioremap_resource() in
the probe function of the fsldma driver. It delegates unmapping to the
devm framework and removes the manual unmapping from the error path and
remove function.

> Convert of_iomap to devm_platform_ioremap_resource to let the devm
> framework handle unmapping. This allows removing the out_iounmap
> label, out_return label, and the explicit iounmap in both the probe
> error path and the remove function.

[Severity: Medium]
Does the commit message inaccurately claim to remove the out_return label?

The diff for this patch only removes the out_iounmap label, so it appears
out_return may have been removed in an earlier patch.

> diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
> index 2efa16d12679a..2a6a247761a47 100644
> --- a/drivers/dma/fsldma.c
> +++ b/drivers/dma/fsldma.c
[ ... ]
> @@ -1309,8 +1307,6 @@ static int fsldma_of_probe(struct platform_device *op)
>  		if (fdev->chan[i])
>  			fsl_dma_chan_remove(fdev->chan[i]);
>  	}

[Severity: High]
This is a pre-existing issue, but does this error path fail to free the
requested IRQs before returning?

If dma_async_device_register() fails during fsldma_of_probe(), the code
jumps to this error path. At this point in the series, the IRQs are managed
via manual request_irq() calls inside fsldma_request_irqs(). However, this
error path fails to call fsldma_free_irqs().

As a result, the IRQ handlers remain registered while the underlying
devres-managed memory (fdev and chan) is automatically freed upon returning.
A subsequently firing interrupt will access freed memory, causing a
use-after-free.

While a later patch in the series converts this to devm_request_irq()
(which fixes the leak), the use-after-free risk persists even at the end
of the series because devres unregisters the IRQ after fsldma_of_probe()
exits, allowing an interrupt to fire and reschedule a killed tasklet.

> -out_iounmap:
> -	iounmap(fdev->regs);
>  	return err;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605220134.43295-1-rosenp@gmail.com?part=5