[PATCH] dmaengine: idxd: Remove channel from list on registration failure

[Ruoyu Wang]

idxd_register_dma_channel() links the channel before registering it.
If dma_async_device_channel_register() fails after that, the error path
frees idxd_chan while chan->device_node remains on dma->channels.

The DMA device can therefore retain a channel list entry that points into
freed idxd_chan memory. Remove the channel from dma->channels before
freeing idxd_chan on the registration failure path, matching the driver's
normal unregister path.

A static analysis checker reported the stale list entry, and manual
source review confirmed the registration failure path.

Fixes: 397862855619 ("dmaengine: idxd: fix dma device lifetime")
Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>
---
 drivers/dma/idxd/dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
index 9937b671f6376..f2c03f3cf1925 100644
--- a/drivers/dma/idxd/dma.c
+++ b/drivers/dma/idxd/dma.c
@@ -289,6 +289,7 @@ static int idxd_register_dma_channel(struct idxd_wq *wq)
 
 	rc = dma_async_device_channel_register(dma, chan, NULL);
 	if (rc < 0) {
+		list_del(&chan->device_node);
 		kfree(idxd_chan);
 		return rc;
 	}
-- 
2.51.0