Re: [PATCHv3] dmaengine: bestcomm: ioremap early

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The global pointer `bcom_eng` is freed on the probe error path but not set to `NULL`, leaving a dangling pointer that can cause a Use-After-Free.
--

commit 0501c17dd28799067260abc5f8abeeda8383de19
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: bestcomm: ioremap early

This commit replaces the open-coded resource lookup, allocation, and mapping
in the mpc52xx_bcom_probe() function with
devm_platform_get_and_ioremap_resource(). It also simplifies the error
handling by removing the manual unmap and release paths.

> diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
> index 432b43520ddc9..44ff4a42376b1 100644
> --- a/drivers/dma/bestcomm/bestcomm.c
> +++ b/drivers/dma/bestcomm/bestcomm.c
[ ... ]
> @@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
>  	return 0;
>  
>  	/* Error path */
> -error_unmap:
> -	iounmap(bcom_eng->regs);
> -error_release:
> -	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
>  error_sramclean:
>  	kfree(bcom_eng);

[Severity: High]
This is a pre-existing issue, but does this error path leave a dangling
global pointer? 

If bcom_engine_init() fails during mpc52xx_bcom_probe(), the global
pointer bcom_eng is freed here but is not reset to NULL. Could
subsequent calls to exported functions like bcom_task_alloc() by
consumer drivers bypass their safety checks (e.g., if (!bcom_eng)) and
attempt to acquire bcom_eng->lock, resulting in a use-after-free and a
kernel crash?

>  	bcom_sram_cleanup();

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908213049.592138-1-rosenp@gmail.com?part=1