dmaengine: bestcomm: set bcom_eng to NULL on probe failure

[PATCH] dmaengine: bestcomm: set bcom_eng to NULL on probe failure

Posted by Rosen Penev 1 month, 1 week ago

Functions like bcom_task_alloc() use if (!bcom_eng) as a safety readiness
check. If the probe fails and hits this error path, subsequent or concurrent
API calls will bypass the check and dereference the freed memory.

Fixes: 9560aea4e9d1 ("[POWERPC] mpc5200: Fix null dereference if bestcomm fails to initialize")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/bestcomm/bestcomm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
index 432b43520ddc..ec58d2c6573f 100644
--- a/drivers/dma/bestcomm/bestcomm.c
+++ b/drivers/dma/bestcomm/bestcomm.c
@@ -445,6 +445,7 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
 error_sramclean:
 	kfree(bcom_eng);
+	bcom_eng = NULL;
 	bcom_sram_cleanup();
 error_ofput:
 	of_node_put(op->dev.of_node);
-- 
2.55.0

Re: [PATCH] dmaengine: bestcomm: set bcom_eng to NULL on probe failure

Posted by Vinod Koul 2 weeks, 4 days ago

On Sun, 16 Aug 2026 18:54:42 -0700, Rosen Penev wrote:
> Functions like bcom_task_alloc() use if (!bcom_eng) as a safety readiness
> check. If the probe fails and hits this error path, subsequent or concurrent
> API calls will bypass the check and dereference the freed memory.
> 
> 

Applied, thanks!

[1/1] dmaengine: bestcomm: set bcom_eng to NULL on probe failure
      commit: 140ebb6d10559a7d2d0c597926f1bfacf03c9f29

Best regards,
-- 
~Vinod

Re: [PATCH] dmaengine: bestcomm: set bcom_eng to NULL on probe failure

Posted by Frank Li 1 month, 1 week ago

On Sun, Aug 16, 2026 at 06:54:42PM -0700, Rosen Penev wrote:
> Functions like bcom_task_alloc() use if (!bcom_eng) as a safety readiness
> check. If the probe fails and hits this error path, subsequent or concurrent
> API calls will bypass the check and dereference the freed memory.
>
> Fixes: 9560aea4e9d1 ("[POWERPC] mpc5200: Fix null dereference if bestcomm fails to initialize")
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---

Not sure that still have power pc user.

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/bestcomm/bestcomm.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
> index 432b43520ddc..ec58d2c6573f 100644
> --- a/drivers/dma/bestcomm/bestcomm.c
> +++ b/drivers/dma/bestcomm/bestcomm.c
> @@ -445,6 +445,7 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
>  	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
>  error_sramclean:
>  	kfree(bcom_eng);
> +	bcom_eng = NULL;
>  	bcom_sram_cleanup();
>  error_ofput:
>  	of_node_put(op->dev.of_node);
> --
> 2.55.0
>