Re: [PATCH v6 04/14] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The DMA device is unregistered after its underlying resources (IRQs and workqueue) are destroyed, which violates teardown symmetry and risks use-after-free.
--

--- Patch [4]: [PATCH v6 04/14] dmaengine: dw-edma: Initialize IRQ data before requesting IRQs ---
commit 987fcaf0e4c8b1c734032a25584db5da396d1c81
Author: Koichiro Den <den@valinux.co.jp>

dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

This patch addresses a potential NULL pointer dereference in
dw_edma_irq_request(). It initializes the back pointer of dw_edma_irq
before calling request_irq(), ensuring that shared interrupts have access
to it.

> diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
> index 3a8610862cff5..ee9a8c32adf4c 100644
> --- a/drivers/dma/dw-edma/dw-edma-core.c
> +++ b/drivers/dma/dw-edma/dw-edma-core.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but does dw_edma_remove() have a teardown
asymmetry that could lead to a use-after-free?

Looking at dw_edma_remove() in drivers/dma/dw-edma/dw-edma-core.c:

	/* Disable eDMA */
	dw_edma_core_off(dw);

	/* Free irqs */
	for (i = (dw->nr_irqs - 1); i >= 0; i--)
		free_irq(chip->ops->irq_vector(dev, i), &dw->irq[i]);

[ ... ]

	destroy_workqueue(dw->wq);

	/* Deregister eDMA device */
	dma_async_device_unregister(&dw->dma);

The DMA device is unregistered after its underlying resources (IRQs and
workqueue) are destroyed.

If a concurrent client requests and interacts with a DMA channel via
dma_request_chan() during module unload or device unbind, could it
access a device that has already had its hardware turned off and interrupts
freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721062815.4117887-1-den@valinux.co.jp?part=4