Re: [PATCH] dmaengine: idxd: Remove channel from list on registration failure

[Frank Li]

On Thu, Jul 09, 2026 at 02:23:03PM +0800, Ruoyu Wang wrote:
> idxd_register_dma_channel() links the channel before registering it.
> If dma_async_device_channel_register() fails after that, the error path
> frees idxd_chan while chan->device_node remains on dma->channels.
>
> The DMA device can therefore retain a channel list entry that points into
> freed idxd_chan memory. Remove the channel from dma->channels before
> freeing idxd_chan on the registration failure path, matching the driver's
> normal unregister path.
>
> A static analysis checker reported the stale list entry, and manual
> source review confirmed the registration failure path.
>
> Fixes: 397862855619 ("dmaengine: idxd: fix dma device lifetime")
> Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>  drivers/dma/idxd/dma.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
> index 9937b671f6376..f2c03f3cf1925 100644
> --- a/drivers/dma/idxd/dma.c
> +++ b/drivers/dma/idxd/dma.c
> @@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
>
>  	rc = dma_async_device_channel_register(dma, chan, NULL);
>  	if (rc < 0) {
> +		list_del(&chan->device_node);
>  		kfree(idxd_chan);
>  		return rc;
>  	}
> --
> 2.51.0
>