Re: [PATCH v2 05/11] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of `ioremap()` is not checked for NULL in `switchtec_dma_create`.
--

--- Patch [5]: [PATCH v2 05/11] dmaengine: switchtec-dma: make switchtec_dma_chans_release() void ---
commit f0ba8482174958251130470e113a8f5fc0e207f1
Author: Logan Gunthorpe <logang@deltatee.com>

dmaengine: switchtec-dma: make switchtec_dma_chans_release() void

It always returned 0, and no caller checked it.

> diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c
> index 13efd4189bbb4..c752a1b05871d 100644
> --- a/drivers/dma/switchtec_dma.c
> +++ b/drivers/dma/switchtec_dma.c
> @@ -1165,15 +1165,13 @@ static int switchtec_dma_chan_free(struct pci_dev *pdev,
>  	return 0;
>  }
>  
> -static int switchtec_dma_chans_release(struct pci_dev *pdev,
> -				       struct switchtec_dma_dev *swdma_dev)
> +static void switchtec_dma_chans_release(struct pci_dev *pdev,
> +					struct switchtec_dma_dev *swdma_dev)
>  {
>  	int i;
>  
>  	for (i = 0; i < swdma_dev->chan_cnt; i++)
>  		switchtec_dma_chan_free(pdev, swdma_dev->swdma_chans[i]);
> -
> -	return 0;
>  }
>  
>  static void switchtec_dma_chans_free(struct switchtec_dma_dev *swdma_dev)

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing I noticed a
pre-existing issue in switchtec_dma_create():

drivers/dma/switchtec_dma.c:switchtec_dma_create() {
        ...
        swdma_dev->bar = ioremap(pci_resource_start(pdev, 0),
                                 pci_resource_len(pdev, 0));

        RCU_INIT_POINTER(swdma_dev->pdev, pdev);

        nr_vecs = pci_msix_vec_count(pdev);
        rc = pci_alloc_irq_vectors(pdev, nr_vecs, nr_vecs, PCI_IRQ_MSIX);
        if (rc < 0)
                goto err_exit;

        irq = readw(swdma_dev->bar + SWITCHTEC_REG_CHAN_STS_VEC);
        ...
}

Does this code check if ioremap() returns NULL?

If ioremap() fails due to memory pressure or physical address space
exhaustion, swdma_dev->bar will be NULL.

The readw() call will then dereference this NULL pointer, which causes
a kernel oops on the device probe path.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721155739.62120-1-logang@deltatee.com?part=5