Re: [PATCH v3] dma: at_hdmac: Fix use-after-free by proper tasklet cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Meaningful code and commit message mismatch: The v3 changelog explicitly claims to keep a defensive NULL check, but no such check exists in the code.
--

--- Patch [1]: [PATCH v3] dma: at_hdmac: Fix use-after-free by proper tasklet  cleanup ---
commit e05118b092320af0ba75bbb64dc2f10dd2eff233
Author: Hongling Zeng <zenghongling@kylinos.cn>

dma: at_hdmac: Fix use-after-free by proper tasklet cleanup

This commit fixes a use-after-free vulnerability by reordering the probe and
remove cleanup paths. It ensures that free_irq is called before killing
tasklets, preventing IRQ handlers from scheduling new tasklets on freed memory.

Closes: https://lore.kernel.org/all/20260604073945.54B311F00898@smtp.kernel.org/

> Change in v3:
> - Reorder probe error path to match remove() cleanup order
> - Keep defensive NULL check for channels cleanup

[Severity: Medium]
This isn't a bug in the code, but the changelog states a defensive NULL
check was kept for the channels cleanup.

Looking at the newly added cleanup function in the diff:

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
[ ... ]
> +static void at_dma_cleanup_channels(struct at_dma *atdma)
> +{
> +	struct dma_chan *chan, *_chan;
> +	int i = 0;
> +
> +	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
> +			device_node) {

Was the defensive check accidentally dropped in at_dma_cleanup_channels,
or does the commit message just need to be updated?

While the code appears safe because the error paths were correctly reordered
to avoid reaching this function with an uninitialized list, the changelog
mismatch might cause confusion.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708022405.24266-1-zenghongling@kylinos.cn?part=1