Re: [PATCH 18/26] dmaengine: stm32-stm32-dma: Remove redundant dev_err()/dev_err_probe()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling pointer in `irqaction->name` leads to a Use-After-Free read when accessing `/proc/interrupts` on probe failure due to premature device name deallocation.
--

--- Patch [18]: [PATCH 18/26] dmaengine: stm32-stm32-dma: Remove redundant dev_err()/dev_err_probe() ---
commit deae2b976db4b82d7a92a5e0ad3b7fc0fc39d45b
Author: Pan Chuang <panchuang@vivo.com>

dmaengine: stm32-stm32-dma: Remove redundant dev_err()/dev_err_probe()

This commit removes redundant driver-specific error logging when
devm_request_irq() fails. The core now logs detailed error messages
automatically.

> diff --git a/drivers/dma/stm32/stm32-dma.c b/drivers/dma/stm32/stm32-dma.c
> index d3ad78562a140..51cb2328a8e19 100644
> --- a/drivers/dma/stm32/stm32-dma.c
> +++ b/drivers/dma/stm32/stm32-dma.c
> @@ -1669,12 +1669,8 @@ static int stm32_dma_probe(struct platform_device *pdev)
>  		ret = devm_request_irq(&pdev->dev, chan->irq,
>  				       stm32_dma_chan_irq, 0,
>  				       dev_name(chan2dev(chan)), chan);
> -		if (ret) {
> -			dev_err(&pdev->dev,
> -				"request_irq failed with err %d channel %d\n",
> -				ret, i);
> +		if (ret)
>  			goto err_unregister;

[Severity: High]
This is a pre-existing issue, but does this error path leave a dangling
pointer in the IRQ subsystem?

In stm32_dma_probe(), the devm_request_irq() call uses
dev_name(chan2dev(chan)) as the IRQ name. The IRQ subsystem stores this
pointer directly in irqaction->name without copying the string.

If the probe function fails and jumps to err_unregister,
dma_async_device_unregister() is called:

err_unregister:
	dma_async_device_unregister(dd);

This unregisters the channel devices and frees their kobject name strings.
Since the IRQs are devm-managed, they remain active until the probe function
completely returns and devres_release_all() cleans them up.

During this window, can a concurrent read of /proc/interrupts access the
freed device name string?

> -		}
>  	}
>  
>  	ret = of_dma_controller_register(pdev->dev.of_node,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709135846.97972-1-panchuang@vivo.com?part=18