From nobody Mon Jun 8 05:24:53 2026 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76F81254B18 for ; Mon, 1 Jun 2026 18:34:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780338859; cv=none; b=D4/IW4Z+RPQy0jei3839IAERTqzyZDmGvdXE/v9R1oy/IobI/L+K0o1kXSIj9H6HPPBwkRmknPEsFlvIorPzgzsJjGW+298zAMqQo2tYPjDycR5uGKLbZiNlleiB9BBAjPXyB7nV6gpR4dZiFOC+getK01IQiX8/3UCaO7GuGyU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780338859; c=relaxed/simple; bh=4BlSnhxudIwdE94lQWc+rpbcBGHGiRrcSvG9E5fcPyI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kOKGVPdBakSxB7atzpq+HLIEVO92kvKZ+pq2R9Kul0mZ12ij3UGBbM9zUWSVlIqBl8ExuN5TmqZyQIyc8sRsuo+rxJrHoZ5cd1gIQqhJ0Vu+GB6NcwK4c9f98AC2/Wk2qExuzp35XxheuglkCH+Kdd+x+S//QsuV78gmwxaYIeQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=p5QJFuQ0; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="p5QJFuQ0" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-36ab8816a35so5040463a91.1 for ; Mon, 01 Jun 2026 11:34:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780338858; x=1780943658; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=V7IhZlFcoO6A06WsDeUJt+rgRSmIqmicbcPIOc+l2zo=; b=p5QJFuQ0wFyFAVd65O9UE60D2a1Q+TE/0HY6PGVyvvVr8TllgWc6IgIPocRwphi0Qa xw1jhcmjXo0t1NENJO5UZvk+OuYgKv2DSIV1ZHrAlihxiWkl+TE4m/7Wc3tZGvP5Hjw0 ksxNYOxBwxwFnk6P0LyeQzsg+7oOOKtQvtCetB+JqveI3cHCPcvSIUjARU6QMCukjt/E LCAAABOx1HVLgVVruzPl4bDhyywB+Ut2Vyhw4TDyqLhNmtjHHjt57OxE8k9Ofi/wYInw lrft0SDPHpSjYIGLKLkRhV5E6ALnETyaN+CjlKbUQgMm9Ct7g2LPK2gkN7kCf44EBkCP vkNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780338858; x=1780943658; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=V7IhZlFcoO6A06WsDeUJt+rgRSmIqmicbcPIOc+l2zo=; b=qZzC1nZDauDAU80pRfAlni2aBX2b6fzJqwhZrj7foRJimA/z1NZEtJ22K7rB/EgPlO nLalxu8GwFKbQzb7b8o12diTFHyj2ywea0QgtPO8OrTStCT78oG3biO4XQVbaXm07x8x XbRoeti2Stx3jpXwyT7yPusNoGXYrIMn7Jzyo1LuKaBjUs6lqCaj1QND7voCH3/vhNZr us8joZjIzKltfiiSsnZ3mRC2b6jekei9miiquByUona3YfWv936Bk7Y9/FBE1SRvlLYN 8cpUfiQ90bzI258MfoHqr6nenoVL1pR548bmttuKLU/+IKziNFrPoWyCOlr1nR5G9//x K09g== X-Forwarded-Encrypted: i=1; AFNElJ8aPlwd3mpfx+toZ6iiNiA5W+AF9vuOsgH/xSC/+DuYcQ2tZUYO6mHxx/XijKeZFNKN11/4iYZGx1fKYcY=@vger.kernel.org X-Gm-Message-State: AOJu0YwxkfSh6V1KQC398/IpXsidu9R3aEOMN6jBl17U3zT09BfxETvl ttG8nEh5N5bkwa2I45Twdzt7lGVhGAIhqdU9KH7jgXW55n8H7D80E1Mb X-Gm-Gg: Acq92OEJ2n5Tg992ckmpnxb/wMudCfXL3OiMtXt7UvFvGt+iLqdAVi8LY7phgnqphta rHrIS5li/b/fdVi2/H823Y5h3my6kxIUPYfFoCEkjMhWA9+i1PmoddAwIZrpSks2EiO05pHZ5mr hJqPoUFqT2zwyijMYZOjHghuzqJ4nvcogtgbDwtb94aXyDAtmtTzkXw423UW2VHnlqhhzZkyUhQ c91ahXKu3KL9McJ1IwyxquVGVcJOXVXQ7moKk08OBIztlwFaouZrZVa+RcvLADsXNdTgU414ugB WGIHyAI+SuHBymQBCQT5GU+P97TG6hIP/HotOrS09VgQ5dDmb1d+SDtEJqAkEFntHcd7HdtGNt8 q7eRdNL7mVTT+z8DqnqR+7VS+3Ik/W97m3zjakcpw2ezeKR8YY+wme7I9PLXvY/cYvkxb+xE+EK Meq4awyBwi2mJc2xk2gYh9fqsrPgIJ6ozG9JHXSbT6P2PZHTFh3c+khWxJy5ObsIXkqUgLSRmXd iIKlri2adI8rmD7dDuWNeOr363pBRbObn0DQBF4ryQKUg== X-Received: by 2002:a17:90b:3d84:b0:369:7421:75cf with SMTP id 98e67ed59e1d1-36c501eb0a7mr12771896a91.16.1780338857619; Mon, 01 Jun 2026 11:34:17 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36bbe1a403esm6447110a91.5.2026.06.01.11.34.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 11:34:16 -0700 (PDT) From: Rosen Penev To: linux-ide@vger.kernel.org Cc: Damien Le Moal , Niklas Cassel , Arnd Bergmann , Vinod Koul , Nikita Shubin , Sergey Shtylyov , linux-kernel@vger.kernel.org (open list) Subject: [PATCH] ata: pata_ep93xx: fix double free and ERR_PTR dereference on DMA error path Date: Mon, 1 Jun 2026 11:33:59 -0700 Message-ID: <20260601183359.11343-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If dma_request_chan(&pdev->dev, "tx") fails during ep93xx_pata_dma_init(), drv_data->dma_tx_channel holds an ERR_PTR. The error path at fail_release_rx releases dma_rx_channel but does not NULL the pointer, then falls through to ep93xx_pata_release_dma() which attempts to release dma_rx_channel again (double free) and calls dma_release_channel() on the ERR_PTR dma_tx_channel (invalid pointer dereference). Fix by NULLing dma_tx_channel before falling through to ep93xx_pata_release_dma(), which will then clean up dma_rx_channel. Fixes: 9963113e3a92 ("ata: pata_ep93xx: add device tree support") Assisted-by: Opencode:Big-Pickle Signed-off-by: Rosen Penev --- drivers/ata/pata_ep93xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c index b2b9e0058333..aa6f8172925d 100644 --- a/drivers/ata/pata_ep93xx.c +++ b/drivers/ata/pata_ep93xx.c @@ -688,7 +688,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data= *drv_data) return 0; =20 fail_release_rx: - dma_release_channel(drv_data->dma_rx_channel); + drv_data->dma_tx_channel =3D NULL; fail_release_dma: ep93xx_pata_release_dma(drv_data); =20 --=20 2.54.0