Re: [PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing tasklet_kill() in the device remove path can lead to Use-After-Free if the device is forcibly unbound.
--

--- Patch [1]: [PATCH RESEND v2] dma: at_hdmac: Use stored IRQ in error path ---
commit a2d04416b94efa75bbae4e7c156c0d75fc20608a
Author: Hongling Zeng <[email protected]>

dma: at_hdmac: Use stored IRQ in error path

When request_irq() succeeds but a later error occurs in at_dma_probe(),
the error handling path attempts to free the IRQ by calling
platform_get_irq() again. This commit updates the error handling path
to use the previously stored irq variable instead, clarifying the code
and resolving warnings.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..2a860679b9e1c 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c

[ ... ]

This is a pre-existing issue, but while reviewing the IRQ and teardown
changes in this file, I noticed a potential problem in at_dma_remove():

drivers/dma/at_hdmac.c:at_dma_remove() {
    ...
	list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels,
			device_node) {
		/* Disable interrupts */
		atc_disable_chan_irq(atdma, chan->chan_id);
		list_del(&chan->device_node);
	}
    ...
}

[Severity: High]
Does this code miss a call to tasklet_kill() for the virtual DMA tasklet?

If a device unbind occurs while a DMA transaction is active, and the DMA
interrupt fires just before free_irq() is called in at_dma_remove(), the
interrupt handler will schedule the virtual DMA tasklet.

Since tasklet_kill() is not called to cancel pending tasklets before
returning, the tasklet remains queued on the CPU softirq list. Once
at_dma_remove() completes and the devres subsystem automatically frees
the atdma memory structure, the tasklet will subsequently execute and
access the freed virt_dma_chan memory. Can this lead to a Use-After-Free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1