dmaengine: fsl-edma: check channel acquisition before use

[PATCH RFC] dmaengine: fsl-edma: check channel acquisition before use

Posted by Slavin Liu 2 weeks ago

dma_get_slave_channel() can return NULL when acquiring a channel fails,
for example if fsl_edma_alloc_chan_resources() cannot request an IRQ.
fsl_edma3_xlate() dereferences that return value to update privatecnt.

Acquire and check the channel before publishing its source ID and
request parameters. A NULL-only check after the existing source-ID
assignment would leave the failed request marked as in use, causing
fsl_edma_srcid_in_use() to reject a subsequent request for that source.
The channel resource-allocation callback does not consume these request
parameters, so set them only after acquisition succeeds. The existing
scoped mutex release and successful-channel return are preserved.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/dma/fsl-edma-main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
index d9fb717b5b53..6934ac882697 100644
--- a/drivers/dma/fsl-edma-main.c
+++ b/drivers/dma/fsl-edma-main.c
@@ -326,13 +326,16 @@ static struct dma_chan *fsl_edma3_xlate(struct of_phandle_args *dma_spec,
 		if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1))
 			continue;
 
+		chan = dma_get_slave_channel(chan);
+		if (!chan)
+			return NULL;
+
 		fsl_chan->srcid = dma_spec->args[0];
 		fsl_chan->priority = dma_spec->args[1];
 		fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX;
 		fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE;
 		fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO;
 
-		chan = dma_get_slave_channel(chan);
 		chan->device->privatecnt++;
 		return chan;
 	}

Re: [PATCH RFC] dmaengine: fsl-edma: check channel acquisition before use

Posted by Vinod Koul 1 week, 2 days ago

On Fri, 11 Sep 2026 14:09:02 +0800, Slavin Liu wrote:
> dma_get_slave_channel() can return NULL when acquiring a channel fails,
> for example if fsl_edma_alloc_chan_resources() cannot request an IRQ.
> fsl_edma3_xlate() dereferences that return value to update privatecnt.
> 
> Acquire and check the channel before publishing its source ID and
> request parameters. A NULL-only check after the existing source-ID
> assignment would leave the failed request marked as in use, causing
> fsl_edma_srcid_in_use() to reject a subsequent request for that source.
> The channel resource-allocation callback does not consume these request
> parameters, so set them only after acquisition succeeds. The existing
> scoped mutex release and successful-channel return are preserved.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: fsl-edma: check channel acquisition before use
      commit: bfd958664fccd794377a8adb74b492498c824643

Best regards,
-- 
~Vinod

Re: [PATCH RFC] dmaengine: fsl-edma: check channel acquisition before use

Posted by Frank Li 1 week, 3 days ago

On Fri, Sep 11, 2026 at 02:09:02PM +0800, Slavin Liu wrote:
> dma_get_slave_channel() can return NULL when acquiring a channel fails,
> for example if fsl_edma_alloc_chan_resources() cannot request an IRQ.
> fsl_edma3_xlate() dereferences that return value to update privatecnt.
>
> Acquire and check the channel before publishing its source ID and
> request parameters. A NULL-only check after the existing source-ID
> assignment would leave the failed request marked as in use, causing
> fsl_edma_srcid_in_use() to reject a subsequent request for that source.
> The channel resource-allocation callback does not consume these request
> parameters, so set them only after acquisition succeeds. The existing
> scoped mutex release and successful-channel return are preserved.
>
> Detected by static analysis and reviewed with AI-assisted source auditing.
>
> Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---

Next time, remove RFC for such patch

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/fsl-edma-main.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
> index d9fb717b5b53..6934ac882697 100644
> --- a/drivers/dma/fsl-edma-main.c
> +++ b/drivers/dma/fsl-edma-main.c
> @@ -326,13 +326,16 @@ static struct dma_chan *fsl_edma3_xlate(struct of_phandle_args *dma_spec,
>  		if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1))
>  			continue;
>
> +		chan = dma_get_slave_channel(chan);
> +		if (!chan)
> +			return NULL;
> +
>  		fsl_chan->srcid = dma_spec->args[0];
>  		fsl_chan->priority = dma_spec->args[1];
>  		fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX;
>  		fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE;
>  		fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO;
>
> -		chan = dma_get_slave_channel(chan);
>  		chan->device->privatecnt++;
>  		return chan;
>  	}

Re: [PATCH RFC] dmaengine: fsl-edma: check channel acquisition before use

Posted by Frank Li 1 week, 6 days ago

On Fri, Sep 11, 2026 at 02:09:02PM +0800, Slavin Liu wrote:

Remove RFC

dmaengine: fsl-edma: check channel acquisition before mark it used.

>
> dma_get_slave_channel() can return NULL when acquiring a channel fails,
> for example if fsl_edma_alloc_chan_resources() cannot request an IRQ.
> fsl_edma3_xlate() dereferences that return value to update privatecnt.
>
> Acquire and check the channel before publishing its source ID and
> request parameters. A NULL-only check after the existing source-ID
> assignment would leave the failed request marked as in use, causing
> fsl_edma_srcid_in_use() to reject a subsequent request for that source.
> The channel resource-allocation callback does not consume these request
> parameters, so set them only after acquisition succeeds. The existing
> scoped mutex release and successful-channel return are preserved.
>
> Detected by static analysis and reviewed with AI-assisted source auditing.

Add Joy Zou, who change this logic recently

Frank

>
> Fixes: 72f5801a4e2b ("dmaengine: fsl-edma: integrate v3 support")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
> ---
>  drivers/dma/fsl-edma-main.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
> index d9fb717b5b53..6934ac882697 100644
> --- a/drivers/dma/fsl-edma-main.c
> +++ b/drivers/dma/fsl-edma-main.c
> @@ -326,13 +326,16 @@ static struct dma_chan *fsl_edma3_xlate(struct of_phandle_args *dma_spec,
>                 if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1))
>                         continue;
>
> +               chan = dma_get_slave_channel(chan);
> +               if (!chan)
> +                       return NULL;
> +
>                 fsl_chan->srcid = dma_spec->args[0];
>                 fsl_chan->priority = dma_spec->args[1];
>                 fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX;
>                 fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE;
>                 fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO;
>
> -               chan = dma_get_slave_channel(chan);
>                 chan->device->privatecnt++;
>                 return chan;
>         }
>