Re: [PATCH] dmaengine: fsl-edma: Fix channel leak in fsl_edma_xlate()

[Frank Li <Frank.li@oss.nxp.com>]

On Wed, Sep 16, 2026 at 09:27:33AM +0000, Wentao Liang wrote:
> fsl_edma_xlate() grabs a channel with dma_get_slave_channel() before
> validating the requested srcid. If the srcid turns out to be invalid,
> the function just returns NULL, leaving the channel with its client
> count elevated and marked private, so it can never be requested again.
>
> Release the channel with dma_release_channel() before returning NULL.
>
> Fixes: 6aa60f79e679 ("dmaengine: fsl-edma: add safety check for 'srcid'")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/dma/fsl-edma-main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
> index 36155ab1602a..11fbf6b1609b 100644
> --- a/drivers/dma/fsl-edma-main.c
> +++ b/drivers/dma/fsl-edma-main.c
> @@ -279,6 +279,7 @@ static struct dma_chan *fsl_edma_xlate(struct of_phandle_args *dma_spec,
>  				if (!fsl_chan->srcid) {
>  					dev_err(&fsl_chan->pdev->dev, "Invalidate srcid %d\n",
>  						fsl_chan->srcid);
> +					dma_release_channel(chan);

fsl_chan->srcid = dma_spec->args[1];

check dma_spec->args[1] before dma_get_slave_channel(chan)

combine into

if (!dma_spec->args[1] || fsl_edma_srcid_in_use(fsl_edma, dma_spec->args[1]))
	return NULL;

Frank

>  					return NULL;
>  				}
>
> --
> 2.34.1
>
>