[PATCH] ata: pata_ep93xx: fix double-free of DMA channel on error path

[Chen Changcheng]

In ep93xx_pata_dma_init() error path, when dma_request_chan() for the tx
channel fails, the code jumps to fail_release_rx which releases the rx
channel via dma_release_channel() and then falls through to
fail_release_dma, which calls ep93xx_pata_release_dma(). This causes a
double-free of dma_rx_channel. Additionally, drv_data->dma_tx_channel
holds an ERR_PTR at this point, so ep93xx_pata_release_dma() would also
attempt to dma_release_channel() on it.

Fix by removing the fail_release_rx label and jumping directly to
fail_release_dma instead. Make ep93xx_pata_release_dma() use
IS_ERR_OR_NULL() so that it safely handles channels that may be
ERR_PTR rather than valid pointers.

Fixes: 9963113e3a92 ("ata: pata_ep93xx: add device tree support")
Signed-off-by: Chen Changcheng <chenchangcheng@xxxxxxxxxx>
---
 drivers/ata/pata_ep93xx.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index 42a24dc51d26..b4fb89481b7e 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -629,11 +629,11 @@ static int ep93xx_pata_bus_softreset(struct ata_port *ap, unsigned int devmask,
 
 static void ep93xx_pata_release_dma(struct ep93xx_pata_data *drv_data)
 {
-	if (drv_data->dma_rx_channel) {
+	if (!IS_ERR_OR_NULL(drv_data->dma_rx_channel)) {
 		dma_release_channel(drv_data->dma_rx_channel);
 		drv_data->dma_rx_channel = NULL;
 	}
-	if (drv_data->dma_tx_channel) {
+	if (!IS_ERR_OR_NULL(drv_data->dma_tx_channel)) {
 		dma_release_channel(drv_data->dma_tx_channel);
 		drv_data->dma_tx_channel = NULL;
 	}
@@ -664,7 +664,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	if (IS_ERR(drv_data->dma_tx_channel)) {
 		ret = dev_err_probe(dev, PTR_ERR(drv_data->dma_tx_channel),
 				    "tx DMA setup failed\n");
-		goto fail_release_rx;
+		goto fail_release_dma;
 	}
 
 	/* Configure receive channel direction and source address */
@@ -691,8 +691,6 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 
 	return 0;
 
-fail_release_rx:
-	dma_release_channel(drv_data->dma_rx_channel);
 fail_release_dma:
 	ep93xx_pata_release_dma(drv_data);
 
-- 
2.25.1