From bfd958664fccd794377a8adb74b492498c824643 Mon Sep 17 00:00:00 2001 From: Slavin Liu Date: Fri, 11 Sep 2026 14:09:02 +0800 Subject: [PATCH] dmaengine: fsl-edma: check channel acquisition before use dma_get_slave_channel() can return NULL when acquiring a channel fails, for example if fsl_edma_alloc_chan_resources() cannot request an IRQ. fsl_edma3_xlate() dereferences that return value to update privatecnt. Acquire and check the channel before publishing its source ID and request parameters. A NULL-only check after the existing source-ID assignment would leave the failed request marked as in use, causing fsl_edma_srcid_in_use() to reject a subsequent request for that source. The channel resource-allocation callback does not consume these request parameters, so set them only after acquisition succeeds. The existing scoped mutex release and successful-channel return are preserved. Detected by static analysis and reviewed with AI-assisted source auditing. Assisted-by: LLM Signed-off-by: Slavin Liu Reviewed-by: Frank Li Link: https://patch.msgid.link/20260911060902.94153-1-bolin.liu@seu.edu.cn Signed-off-by: Vinod Koul --- drivers/dma/fsl-edma-main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c index d9fb717b5b53..6934ac882697 100644 --- a/drivers/dma/fsl-edma-main.c +++ b/drivers/dma/fsl-edma-main.c @@ -326,13 +326,16 @@ static struct dma_chan *fsl_edma3_xlate(struct of_phandle_args *dma_spec, if ((dma_spec->args[2] & FSL_EDMA_ODD_CH) && !(i & 0x1)) continue; + chan = dma_get_slave_channel(chan); + if (!chan) + return NULL; + fsl_chan->srcid = dma_spec->args[0]; fsl_chan->priority = dma_spec->args[1]; fsl_chan->is_rxchan = dma_spec->args[2] & FSL_EDMA_RX; fsl_chan->is_remote = dma_spec->args[2] & FSL_EDMA_REMOTE; fsl_chan->is_multi_fifo = dma_spec->args[2] & FSL_EDMA_MULTI_FIFO; - chan = dma_get_slave_channel(chan); chan->device->privatecnt++; return chan; }