[PATCH v2] dmaengine: fsl-edma: Fix channel leak in fsl_edma_xlate()

[Wentao Liang]

fsl_edma_xlate() acquires a channel with dma_get_slave_channel() and only
then validates the srcid taken from the device tree. When the srcid turns
out to be invalid the function just returns NULL, leaving the channel
with its client count elevated and marked private, so it can never be
requested again.

Validate the srcid before any channel is acquired: reject a zero srcid
and a srcid that is already in use up front. With that, no channel can be
leaked on the error path and the release added in v1 is not needed.

Fixes: 6aa60f79e679 ("dmaengine: fsl-edma: add safety check for 'srcid'")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
Changes in v2:
- Check dma_spec->args[1] before dma_get_slave_channel() instead of
  releasing the channel on the error path, as Frank Li suggested. The
  zero-srcid test is folded into the existing fsl_edma_srcid_in_use()
  check, so the code stays where it is.
- Link to v1: https://lore.kernel.org/all/20260916092733.2002700-1-vulab@xxxxxxxxxxx/
- Sorry for the very late reply to this review.

 drivers/dma/fsl-edma-main.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
index 630285c85482..e2ef18ad1a3e 100644
--- a/drivers/dma/fsl-edma-main.c
+++ b/drivers/dma/fsl-edma-main.c
@@ -266,7 +266,8 @@ static struct dma_chan *fsl_edma_xlate(struct of_phandle_args *dma_spec,
 		if (chan->client_count)
 			continue;
 
-		if (fsl_edma_srcid_in_use(fsl_edma, dma_spec->args[1]))
+		if (!dma_spec->args[1] ||
+		    fsl_edma_srcid_in_use(fsl_edma, dma_spec->args[1]))
 			return NULL;
 
 		if ((chan->chan_id / chans_per_mux) == dma_spec->args[0]) {
@@ -275,13 +276,6 @@ static struct dma_chan *fsl_edma_xlate(struct of_phandle_args *dma_spec,
 				chan->device->privatecnt++;
 				fsl_chan = to_fsl_edma_chan(chan);
 				fsl_chan->srcid = dma_spec->args[1];
-
-				if (!fsl_chan->srcid) {
-					dev_err(&fsl_chan->pdev->dev, "Invalidate srcid %d\n",
-						fsl_chan->srcid);
-					return NULL;
-				}
-
 				fsl_edma_chan_mux(fsl_chan, fsl_chan->srcid,
 						true);
 				return chan;
-- 
2.34.1