Re: [PATCH] dmaengine: validate dev and name in dma_request_chan()

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Jul 16, 2026 at 12:27:58PM +0700, phucduc.bui@gmail.com wrote:
> From: bui duc phuc <phucduc.bui@gmail.com>
>
> dma_request_chan() assumes both @dev and @name are valid, but neither is
> checked before use.
>
> dev is dereferenced immediately via dev_fwnode(), which accesses
> dev->of_node or dev->fwnode without checking for NULL. Likewise, if name is
> NULL and the OF/ACPI lookup does not succeed, the legacy filter-map path
> eventually passes it to strcmp(), resulting in a NULL pointer dereference.
>
> These are caller bugs rather than normal lookup failures, so add a
> WARN_ON() at function entry to catch invalid arguments early during
> development instead of crashing later.
>
> No functional change for valid callers.
>
> Signed-off-by: bui duc phuc <phucduc.bui@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/dmaengine.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
> index 9049171df857..7b479cd93b9b 100644
> --- a/drivers/dma/dmaengine.c
> +++ b/drivers/dma/dmaengine.c
> @@ -814,10 +814,15 @@ static const struct dma_slave_map *dma_filter_match(struct dma_device *device,
>   */
>  struct dma_chan *dma_request_chan(struct device *dev, const char *name)
>  {
> -	struct fwnode_handle *fwnode = dev_fwnode(dev);
> +	struct fwnode_handle *fwnode;
>  	struct dma_device *d, *_d;
>  	struct dma_chan *chan = NULL;
>
> +	if (WARN_ON(!dev || !name))
> +		return ERR_PTR(-EINVAL);
> +
> +	fwnode = dev_fwnode(dev);
> +
>  	if (is_of_node(fwnode))
>  		chan = of_dma_request_slave_channel(to_of_node(fwnode), name);
>  	else if (is_acpi_device_node(fwnode))
> --
> 2.43.0
>