Re: [PATCH v2 04/11] dmaengine: switchtec-dma: fix channel leak on registration failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Use-After-Free of `swdma_dev` when unmapping BAR in driver removal.
--

--- Patch [4]: [PATCH v2 04/11] dmaengine: switchtec-dma: fix channel leak on registration failure ---
commit 180269dedc262dabc95c3a154c59d53224e70c16
Author: Logan Gunthorpe <logang@deltatee.com>

    dmaengine: switchtec-dma: fix channel leak on registration failure

    switchtec_dma_chans_release() is called in three places but the
    underlying memory is not freed in all of those places. In order to
    clean this up, introduce a switchtec_dma_chans_free() helper that
    will free the memory. Ensure each call to switchtec_dma_chans_release()
    has a corresponding switchtec_dma_chans_free() call.

    Link: https://lore.kernel.org/dmaengine/20260717223024.9BB8A1F000E9@smtp.kernel.org

> diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c
> index 107769cca772f..13efd4189bbb4 100644
> --- a/drivers/dma/switchtec_dma.c
> +++ b/drivers/dma/switchtec_dma.c
[ ... ]
> @@ -1221,12 +1229,8 @@ static void switchtec_dma_release(struct dma_device *dma_dev)
>  {
>  	struct switchtec_dma_dev *swdma_dev =
>  		container_of(dma_dev, struct switchtec_dma_dev, dma_dev);
> -	int i;
>  
> -	for (i = 0; i < swdma_dev->chan_cnt; i++)
> -		kfree(swdma_dev->swdma_chans[i]);
> -
> -	kfree(swdma_dev->swdma_chans);
> +	switchtec_dma_chans_free(swdma_dev);
>  
>  	put_device(dma_dev->dev);
>  	kfree(swdma_dev);

[Severity: Critical]
This is a pre-existing issue, but does this kfree() result in a
use-after-free during driver removal?

In switchtec_dma_remove(), when dma_async_device_unregister() drops the
final reference, it synchronously invokes this switchtec_dma_release()
callback which frees swdma_dev.

However, switchtec_dma_remove() then immediately accesses the freed
swdma_dev pointer:

drivers/dma/switchtec_dma.c:switchtec_dma_remove() {
    ...
	dma_async_device_unregister(&swdma_dev->dma_dev);

	iounmap(swdma_dev->bar);
    ...
}

Should the iounmap() be moved before dma_async_device_unregister(), or
should the bar pointer be saved to a local variable to prevent memory
corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721155739.62120-1-logang@deltatee.com?part=4