[v1] dmaengine: fsl_raid: check fsl_re_chan_probe() return value

[PATCH] dmaengine: fsl_raid: check fsl_re_chan_probe() return value

Posted by Rosen Penev 6 days, 4 hours ago

fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
unconditionally increments total_chans. When a channel fails to probe
(for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
total_chans still advances, so fsl_re_remove_chan() later dereferences the
NULL pointer during device removal.

Propagate the error, only count successfully probed channels, and guard
fsl_re_remove() against NULL entries.

Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/fsl_raid.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index bfaef6245695..0b0b4e8fc821 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -842,7 +842,14 @@ static int fsl_re_probe(struct platform_device *ofdev)
 			rc = of_device_is_compatible(child,
 					     "fsl,raideng-v1.0-job-ring");
 			if (rc) {
-				fsl_re_chan_probe(ofdev, child, ridx++, off);
+				rc = fsl_re_chan_probe(ofdev, child, ridx, off);
+				if (rc) {
+					dev_err(dev,
+						"job ring %d probe failed: %d\n",
+						ridx, rc);
+					continue;
+				}
+				ridx++;
 				re_priv->total_chans++;
 			}
 		}
@@ -875,7 +882,8 @@ static void fsl_re_remove(struct platform_device *ofdev)
 
 	/* Cleanup chan related memory areas */
 	for (i = 0; i < re_priv->total_chans; i++)
-		fsl_re_remove_chan(re_priv->re_jrs[i]);
+		if (re_priv->re_jrs[i])
+			fsl_re_remove_chan(re_priv->re_jrs[i]);
 
 	/* Unregister the driver */
 	dma_async_device_unregister(&re_priv->dma_dev);
-- 
2.55.0

Re: [PATCH] dmaengine: fsl_raid: check fsl_re_chan_probe() return value

Posted by Frank Li 4 days, 11 hours ago

On Sat, Jul 18, 2026 at 04:15:21PM -0700, Rosen Penev wrote:
> fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
> unconditionally increments total_chans. When a channel fails to probe
> (for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
> total_chans still advances, so fsl_re_remove_chan() later dereferences the
> NULL pointer during device removal.
>
> Propagate the error, only count successfully probed channels, and guard

It is not Propagate the error to caller.

Check return value and only count ....

Frank


> fsl_re_remove() against NULL entries.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/dma/fsl_raid.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index bfaef6245695..0b0b4e8fc821 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -842,7 +842,14 @@ static int fsl_re_probe(struct platform_device *ofdev)
>  			rc = of_device_is_compatible(child,
>  					     "fsl,raideng-v1.0-job-ring");
>  			if (rc) {
> -				fsl_re_chan_probe(ofdev, child, ridx++, off);
> +				rc = fsl_re_chan_probe(ofdev, child, ridx, off);
> +				if (rc) {
> +					dev_err(dev,
> +						"job ring %d probe failed: %d\n",
> +						ridx, rc);
> +					continue;
> +				}
> +				ridx++;
>  				re_priv->total_chans++;
>  			}
>  		}
> @@ -875,7 +882,8 @@ static void fsl_re_remove(struct platform_device *ofdev)
>
>  	/* Cleanup chan related memory areas */
>  	for (i = 0; i < re_priv->total_chans; i++)
> -		fsl_re_remove_chan(re_priv->re_jrs[i]);
> +		if (re_priv->re_jrs[i])
> +			fsl_re_remove_chan(re_priv->re_jrs[i]);
>
>  	/* Unregister the driver */
>  	dma_async_device_unregister(&re_priv->dma_dev);
> --
> 2.55.0
>