[PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value
From: Rosen Penev <hidden>
Date: 2026-09-10 20:06:40
Also in:
lkml
Subsystem:
dma generic offload engine subsystem, the rest · Maintainers:
Vinod Koul, Linus Torvalds
fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
unconditionally increments total_chans. When a channel fails to probe
(for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
total_chans still advances, so fsl_re_remove_chan() later dereferences the
NULL pointer during device removal.
Check return value and only count successfully probed channels, and guard
fsl_re_remove() against NULL entries.
Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <redacted>
---
v4: use break;
v3: fix sashiko review
v2: fix description
drivers/dma/fsl_raid.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index 9cc289f7129e..6167fa652e96 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c@@ -836,18 +836,32 @@ static int fsl_re_probe(struct platform_device *ofdev) } /* Find out the Job Rings present under each JQ */ for_each_child_of_node(np, child) { + if (ridx >= FSL_RE_MAX_CHANS) { + dev_warn(dev, + "too many job rings, max %d\n", + FSL_RE_MAX_CHANS); + of_node_put(child); + break; + } + rc = of_device_is_compatible(child, "fsl,raideng-v1.0-job-ring"); + if (!rc) + continue; + + rc = fsl_re_chan_probe(ofdev, child, ridx, off); if (rc) { - fsl_re_chan_probe(ofdev, child, ridx++, off); - re_priv->total_chans++; + dev_err(dev, + "job ring %d probe failed: %d\n", + ridx, rc); + continue; } + ridx++; + re_priv->total_chans++; } } - dma_async_device_register(dma_dev); - - return 0; + return dma_async_device_register(dma_dev); } static void fsl_re_remove_chan(struct fsl_re_chan *chan)
@@ -872,7 +886,8 @@ static void fsl_re_remove(struct platform_device *ofdev) /* Cleanup chan related memory areas */ for (i = 0; i < re_priv->total_chans; i++) - fsl_re_remove_chan(re_priv->re_jrs[i]); + if (re_priv->re_jrs[i]) + fsl_re_remove_chan(re_priv->re_jrs[i]); /* Unregister the driver */ dma_async_device_unregister(&re_priv->dma_dev);
--
2.55.0