[PATCH] dmaengine: validate dev and name in dma_request_chan()

From: phucduc . bui

Date: Thu Jul 16 2026 - 01:30:17 EST


From: bui duc phuc <phucduc.bui@xxxxxxxxx>

dma_request_chan() assumes both @dev and @name are valid, but neither is
checked before use.

dev is dereferenced immediately via dev_fwnode(), which accesses
dev->of_node or dev->fwnode without checking for NULL. Likewise, if name is
NULL and the OF/ACPI lookup does not succeed, the legacy filter-map path
eventually passes it to strcmp(), resulting in a NULL pointer dereference.

These are caller bugs rather than normal lookup failures, so add a
WARN_ON() at function entry to catch invalid arguments early during
development instead of crashing later.

No functional change for valid callers.

Signed-off-by: bui duc phuc <phucduc.bui@xxxxxxxxx>
---
drivers/dma/dmaengine.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 9049171df857..7b479cd93b9b 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -814,10 +814,15 @@ static const struct dma_slave_map *dma_filter_match(struct dma_device *device,
*/
struct dma_chan *dma_request_chan(struct device *dev, const char *name)
{
- struct fwnode_handle *fwnode = dev_fwnode(dev);
+ struct fwnode_handle *fwnode;
struct dma_device *d, *_d;
struct dma_chan *chan = NULL;

+ if (WARN_ON(!dev || !name))
+ return ERR_PTR(-EINVAL);
+
+ fwnode = dev_fwnode(dev);
+
if (is_of_node(fwnode))
chan = of_dma_request_slave_channel(to_of_node(fwnode), name);
else if (is_acpi_device_node(fwnode))
--
2.43.0