fsl_edma_xlate() grabs a channel with dma_get_slave_channel() before
validating the requested srcid. If the srcid turns out to be invalid,
the function just returns NULL, leaving the channel with its client
count elevated and marked private, so it can never be requested again.

Release the channel with dma_release_channel() before returning NULL.

Fixes: 6aa60f79e679 ("dmaengine: fsl-edma: add safety check for 'srcid'")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/dma/fsl-edma-main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
index 36155ab1602a..11fbf6b1609b 100644
--- a/drivers/dma/fsl-edma-main.c
+++ b/drivers/dma/fsl-edma-main.c
@@ -279,6 +279,7 @@ static struct dma_chan *fsl_edma_xlate(struct of_phandle_args *dma_spec,
 				if (!fsl_chan->srcid) {
 					dev_err(&fsl_chan->pdev->dev, "Invalidate srcid %d\n",
 						fsl_chan->srcid);
+					dma_release_channel(chan);
 					return NULL;
 				}
 
-- 
2.34.1

On Wed, Sep 16, 2026 at 09:27:33AM +0000, Wentao Liang wrote:
> fsl_edma_xlate() grabs a channel with dma_get_slave_channel() before
> validating the requested srcid. If the srcid turns out to be invalid,
> the function just returns NULL, leaving the channel with its client
> count elevated and marked private, so it can never be requested again.
>
> Release the channel with dma_release_channel() before returning NULL.
>
> Fixes: 6aa60f79e679 ("dmaengine: fsl-edma: add safety check for 'srcid'")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/dma/fsl-edma-main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
> index 36155ab1602a..11fbf6b1609b 100644
> --- a/drivers/dma/fsl-edma-main.c
> +++ b/drivers/dma/fsl-edma-main.c
> @@ -279,6 +279,7 @@ static struct dma_chan *fsl_edma_xlate(struct of_phandle_args *dma_spec,
>  				if (!fsl_chan->srcid) {
>  					dev_err(&fsl_chan->pdev->dev, "Invalidate srcid %d\n",
>  						fsl_chan->srcid);
> +					dma_release_channel(chan);

fsl_chan->srcid = dma_spec->args[1];

check dma_spec->args[1] before dma_get_slave_channel(chan)

combine into

if (!dma_spec->args[1] || fsl_edma_srcid_in_use(fsl_edma, dma_spec->args[1]))
	return NULL;

Frank

>  					return NULL;
>  				}
>
> --
> 2.34.1
>
>