* [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value
@ 2026-09-10 20:06 Rosen Penev
2026-09-11 15:21 ` Frank Li
2026-09-15 16:31 ` Vinod Koul
0 siblings, 2 replies; 3+ messages in thread
From: Rosen Penev @ 2026-09-10 20:06 UTC (permalink / raw)
To: dmaengine; +Cc: Vinod Koul, Frank Li, Xuelin Shi, Harninder Rai, open list
fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
unconditionally increments total_chans. When a channel fails to probe
(for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
total_chans still advances, so fsl_re_remove_chan() later dereferences the
NULL pointer during device removal.
Check return value and only count successfully probed channels, and guard
fsl_re_remove() against NULL entries.
Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
v4: use break;
v3: fix sashiko review
v2: fix description
drivers/dma/fsl_raid.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index 9cc289f7129e..6167fa652e96 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -836,18 +836,32 @@ static int fsl_re_probe(struct platform_device *ofdev)
}
/* Find out the Job Rings present under each JQ */
for_each_child_of_node(np, child) {
+ if (ridx >= FSL_RE_MAX_CHANS) {
+ dev_warn(dev,
+ "too many job rings, max %d\n",
+ FSL_RE_MAX_CHANS);
+ of_node_put(child);
+ break;
+ }
+
rc = of_device_is_compatible(child,
"fsl,raideng-v1.0-job-ring");
+ if (!rc)
+ continue;
+
+ rc = fsl_re_chan_probe(ofdev, child, ridx, off);
if (rc) {
- fsl_re_chan_probe(ofdev, child, ridx++, off);
- re_priv->total_chans++;
+ dev_err(dev,
+ "job ring %d probe failed: %d\n",
+ ridx, rc);
+ continue;
}
+ ridx++;
+ re_priv->total_chans++;
}
}
- dma_async_device_register(dma_dev);
-
- return 0;
+ return dma_async_device_register(dma_dev);
}
static void fsl_re_remove_chan(struct fsl_re_chan *chan)
@@ -872,7 +886,8 @@ static void fsl_re_remove(struct platform_device *ofdev)
/* Cleanup chan related memory areas */
for (i = 0; i < re_priv->total_chans; i++)
- fsl_re_remove_chan(re_priv->re_jrs[i]);
+ if (re_priv->re_jrs[i])
+ fsl_re_remove_chan(re_priv->re_jrs[i]);
/* Unregister the driver */
dma_async_device_unregister(&re_priv->dma_dev);
--
2.55.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value
2026-09-10 20:06 [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value Rosen Penev
@ 2026-09-11 15:21 ` Frank Li
2026-09-15 16:31 ` Vinod Koul
1 sibling, 0 replies; 3+ messages in thread
From: Frank Li @ 2026-09-11 15:21 UTC (permalink / raw)
To: Rosen Penev
Cc: dmaengine, Vinod Koul, Frank Li, Xuelin Shi, Harninder Rai, open list
On Thu, Sep 10, 2026 at 01:06:37PM -0700, Rosen Penev wrote:
> fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
> unconditionally increments total_chans. When a channel fails to probe
> (for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
> total_chans still advances, so fsl_re_remove_chan() later dereferences the
> NULL pointer during device removal.
>
> Check return value and only count successfully probed channels, and guard
> fsl_re_remove() against NULL entries.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
> v4: use break;
> v3: fix sashiko review
> v2: fix description
> drivers/dma/fsl_raid.c | 27 +++++++++++++++++++++------
> 1 file changed, 21 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index 9cc289f7129e..6167fa652e96 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -836,18 +836,32 @@ static int fsl_re_probe(struct platform_device *ofdev)
> }
> /* Find out the Job Rings present under each JQ */
> for_each_child_of_node(np, child) {
> + if (ridx >= FSL_RE_MAX_CHANS) {
> + dev_warn(dev,
> + "too many job rings, max %d\n",
> + FSL_RE_MAX_CHANS);
> + of_node_put(child);
> + break;
> + }
> +
> rc = of_device_is_compatible(child,
> "fsl,raideng-v1.0-job-ring");
> + if (!rc)
> + continue;
> +
> + rc = fsl_re_chan_probe(ofdev, child, ridx, off);
> if (rc) {
> - fsl_re_chan_probe(ofdev, child, ridx++, off);
> - re_priv->total_chans++;
> + dev_err(dev,
> + "job ring %d probe failed: %d\n",
> + ridx, rc);
> + continue;
> }
> + ridx++;
> + re_priv->total_chans++;
> }
> }
>
> - dma_async_device_register(dma_dev);
> -
> - return 0;
> + return dma_async_device_register(dma_dev);
> }
>
> static void fsl_re_remove_chan(struct fsl_re_chan *chan)
> @@ -872,7 +886,8 @@ static void fsl_re_remove(struct platform_device *ofdev)
>
> /* Cleanup chan related memory areas */
> for (i = 0; i < re_priv->total_chans; i++)
> - fsl_re_remove_chan(re_priv->re_jrs[i]);
> + if (re_priv->re_jrs[i])
> + fsl_re_remove_chan(re_priv->re_jrs[i]);
>
> /* Unregister the driver */
> dma_async_device_unregister(&re_priv->dma_dev);
> --
> 2.55.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value
2026-09-10 20:06 [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value Rosen Penev
2026-09-11 15:21 ` Frank Li
@ 2026-09-15 16:31 ` Vinod Koul
1 sibling, 0 replies; 3+ messages in thread
From: Vinod Koul @ 2026-09-15 16:31 UTC (permalink / raw)
To: Rosen Penev; +Cc: dmaengine, Frank Li, Xuelin Shi, Harninder Rai, open list
On 10-09-26, 13:06, Rosen Penev wrote:
> fsl_re_probe() ignores the return value of fsl_re_chan_probe() and
> unconditionally increments total_chans. When a channel fails to probe
> (for example, an IRQ mapping failure) its re_jrs[] slot is left NULL, yet
> total_chans still advances, so fsl_re_remove_chan() later dereferences the
> NULL pointer during device removal.
>
> Check return value and only count successfully probed channels, and guard
> fsl_re_remove() against NULL entries.
>
> Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
> Assisted-by: opencode:hy3-free
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
> v4: use break;
> v3: fix sashiko review
> v2: fix description
> drivers/dma/fsl_raid.c | 27 +++++++++++++++++++++------
> 1 file changed, 21 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
> index 9cc289f7129e..6167fa652e96 100644
> --- a/drivers/dma/fsl_raid.c
> +++ b/drivers/dma/fsl_raid.c
> @@ -836,18 +836,32 @@ static int fsl_re_probe(struct platform_device *ofdev)
> }
> /* Find out the Job Rings present under each JQ */
> for_each_child_of_node(np, child) {
> + if (ridx >= FSL_RE_MAX_CHANS) {
> + dev_warn(dev,
> + "too many job rings, max %d\n",
> + FSL_RE_MAX_CHANS);
what is wrong with:
dev_warn(dev, too many job rings, max %d\n", FSL_RE_MAX_CHANS);
exceeds 80chars but makes reading less painful!
> + of_node_put(child);
> + break;
> + }
> +
> rc = of_device_is_compatible(child,
> "fsl,raideng-v1.0-job-ring");
> + if (!rc)
> + continue;
> +
> + rc = fsl_re_chan_probe(ofdev, child, ridx, off);
> if (rc) {
> - fsl_re_chan_probe(ofdev, child, ridx++, off);
> - re_priv->total_chans++;
> + dev_err(dev,
> + "job ring %d probe failed: %d\n",
> + ridx, rc);
here as well
> + continue;
> }
> + ridx++;
> + re_priv->total_chans++;
> }
> }
>
> - dma_async_device_register(dma_dev);
> -
> - return 0;
> + return dma_async_device_register(dma_dev);
> }
>
> static void fsl_re_remove_chan(struct fsl_re_chan *chan)
> @@ -872,7 +886,8 @@ static void fsl_re_remove(struct platform_device *ofdev)
>
> /* Cleanup chan related memory areas */
> for (i = 0; i < re_priv->total_chans; i++)
> - fsl_re_remove_chan(re_priv->re_jrs[i]);
> + if (re_priv->re_jrs[i])
> + fsl_re_remove_chan(re_priv->re_jrs[i]);
>
> /* Unregister the driver */
> dma_async_device_unregister(&re_priv->dma_dev);
> --
> 2.55.0
--
~Vinod
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-15 16:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-10 20:06 [PATCHv4] dmaengine: fsl_raid: check fsl_re_chan_probe() return value Rosen Penev
2026-09-11 15:21 ` Frank Li
2026-09-15 16:31 ` Vinod Koul
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®