Re: [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value
From: Vinod Koul <vkoul@kernel.org>
Date: 2026-09-15 16:31:39
Also in:
lkml
On 10-09-26, 13:06, Rosen Penev wrote:
quoted hunk ↗ jump to hunk
fsl_re_probe() ignores the return value of fsl_re_chan_probe() and unconditionally increments total_chans. When a channel fails to probe (for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet total_chans still advances, so fsl_re_remove_chan() later dereferences the NULL pointer during device removal. Check return value and only count successfully probed channels, and guard fsl_re_remove() against NULL entries. Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.") Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev <redacted> --- v4: use break; v3: fix sashiko review v2: fix description drivers/dma/fsl_raid.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c index 9cc289f7129e..6167fa652e96 100644 --- a/drivers/dma/fsl_raid.c +++ b/drivers/dma/fsl_raid.c@@ -836,18 +836,32 @@ static int fsl_re_probe(struct platform_device *ofdev) } /* Find out the Job Rings present under each JQ */ for_each_child_of_node(np, child) { + if (ridx >= FSL_RE_MAX_CHANS) { + dev_warn(dev, + "too many job rings, max %d\n", + FSL_RE_MAX_CHANS);
what is wrong with:
dev_warn(dev, too many job rings, max %d\n", FSL_RE_MAX_CHANS);
exceeds 80chars but makes reading less painful!
+ of_node_put(child);
+ break;
+ }
+
rc = of_device_is_compatible(child,
"fsl,raideng-v1.0-job-ring");
+ if (!rc)
+ continue;
+
+ rc = fsl_re_chan_probe(ofdev, child, ridx, off);
if (rc) {
- fsl_re_chan_probe(ofdev, child, ridx++, off);
- re_priv->total_chans++;
+ dev_err(dev,
+ "job ring %d probe failed: %d\n",
+ ridx, rc);here as well
quoted hunk ↗ jump to hunk
+ continue; } + ridx++; + re_priv->total_chans++; } } - dma_async_device_register(dma_dev); - - return 0; + return dma_async_device_register(dma_dev); } static void fsl_re_remove_chan(struct fsl_re_chan *chan)@@ -872,7 +886,8 @@ static void fsl_re_remove(struct platform_device *ofdev) /* Cleanup chan related memory areas */ for (i = 0; i < re_priv->total_chans; i++) - fsl_re_remove_chan(re_priv->re_jrs[i]); + if (re_priv->re_jrs[i]) + fsl_re_remove_chan(re_priv->re_jrs[i]); /* Unregister the driver */ dma_async_device_unregister(&re_priv->dma_dev);-- 2.55.0
-- ~Vinod