Re: [PATCH v3] dma: at_hdmac: Fix use-after-free by proper tasklet cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Mismatch between commit message and implementation regarding list_empty() check
--

--- Patch [1]: [PATCH v3] dma: at_hdmac: Fix use-after-free by proper tasklet  cleanup ---
commit e5bf642ad51db020b1e407d27b314f3478d2609a
Author: Hongling Zeng <zenghongling@kylinos.cn>

dma: at_hdmac: Fix use-after-free by proper tasklet cleanup

This commit addresses a use-after-free vulnerability in the cleanup and probe
error paths of the at_hdmac driver. It ensures free_irq() is called before
killing tasklets and freeing other resources, properly synchronizing with
running IRQ handlers.

Closes: https://lore.kernel.org/all/20260604073945.54B311F00898@smtp.kernel.org/

> Change in v3:
[ ... ]
> - Replace incorrect channels.next != NULL check (always true after
>   INIT_LIST_HEAD) with proper list_empty() check
[ ... ]
> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..044a0fb38b7a9 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
[ ... ]
> @@ -1940,6 +1940,20 @@ static void at_dma_off(struct at_dma *atdma)
>  		cpu_relax();
>  }
>  
> +static void at_dma_cleanup_channels(struct at_dma *atdma)
> +{
> +	struct dma_chan *chan, *_chan;
> +	int i = 0;
> +
> +	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
> +			device_node) {

[Severity: Medium]
This isn't a bug, but the v3 changelog explicitly mentions replacing an
incorrect channels.next check with a proper list_empty() check. Does this
function actually implement that check?

While list_for_each_entry_safe() inherently handles empty lists correctly,
making an explicit check functionally unnecessary, there appears to be a
direct contradiction between the stated changes and the final code.

Should the commit message be updated to reflect that the check was simply
removed entirely, or was the list_empty() check accidentally omitted here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708023035.27194-1-zenghongling@kylinos.cn?part=1