Re: [PATCH v3 11/11] dmaengine: plx_dma: fix NULL pointer deref in plx_dma_isr()

On Mon, Jul 27, 2026 at 12:15:26PM -0600, Logan Gunthorpe wrote:
> plx_dma_create() registered the interrupt handler with request_irq()
> before initializing plxdev->bar. If the device raised an interrupt in
> that window, plx_dma_isr() would dereference the still-NULL bar.
>
> Move the bar assignment ahead of request_irq() so everything the
> handler can touch is initialized before it can run.
>
> Reported-by: Sangyun Kim <[email protected]>
> Reported-by: Kyungwook Boo <[email protected]>
> Link: https://lore.kernel.org/all/[email protected]
> Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization and cleanup")
> Signed-off-by: Logan Gunthorpe <[email protected]>
> ---

Reviewed-by: Frank Li <[email protected]>

>  drivers/dma/plx_dma.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
> index 84941a918b01..409898e92c32 100644
> --- a/drivers/dma/plx_dma.c
> +++ b/drivers/dma/plx_dma.c
> @@ -504,17 +504,17 @@ static int plx_dma_create(struct pci_dev *pdev)
>  	if (!plxdev)
>  		return -ENOMEM;
>
> -	rc = request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0,
> -			 KBUILD_MODNAME, plxdev);
> -	if (rc)
> -		goto free_plx;
> -
>  	spin_lock_init(&plxdev->ring_lock);
>  	tasklet_setup(&plxdev->desc_task, plx_dma_desc_task);
>
>  	RCU_INIT_POINTER(plxdev->pdev, pdev);
>  	plxdev->bar = pcim_iomap_table(pdev)[0];
>
> +	rc = request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0,
> +			 KBUILD_MODNAME, plxdev);
> +	if (rc)
> +		goto free_plx;
> +
>  	dma = &plxdev->dma_dev;
>  	INIT_LIST_HEAD(&dma->channels);
>  	dma_cap_set(DMA_MEMCPY, dma->cap_mask);
> --
> 2.47.3
>