dmaengine: bestcomm: ioremap early

PATCH Superseded Rosen Penev 3 participants 3 messages Sep 2 – Sep 4 dmaengine

Share & tools

Rosen Penev

author

2026-09-02 21:46 UTC #0 lore raw

PATCH v2 1/1 dmaengine: bestcomm: ioremap early

ioremap early as devm_platform_get_and_ioremap_resource() only needs a platform_device pointer. Also avoid doing work before alllocating the main
struct.

Replace the open-coded resource lookup, request_mem_region, ioremap and the manual iounmap/release_mem_region cleanup in probe/remove with the managed devm_platform_get_and_ioremap_resource() helper. This removes the now-unused error-unmap/release paths and simplifies probing.

This also fixes a resource size mismatch between allocating and freeing where request_mem_region() and release_mem_region() hopefully use the same size but is not guarenteed.

Signed-off-by Rosen Penev <[email protected]>

---
v2: remove Sashiko generated description. Reword description.

 drivers/dma/bestcomm/bestcomm.c | 45 ++++++++-------------------------
 1 file changed, 10 insertions(+), 35 deletions(-)

drivers/dma/bestcomm/bestcomm.c +10 ~~-35~~

index 432b43520ddc..44ff4a42376b 100644
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/of.h>
-#include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/platform_device.h>
 #include <asm/io.h>

@@ -365,13 +364,19 @@ bcom_engine_cleanup(void)
 static int mpc52xx_bcom_probe(struct platform_device *op)
 {
 	struct device_node *ofn_sram;
-	struct resource res_bcom;
+	struct resource *res_bcom;
+	void __iomem *regs;
 
 	int rv;
 
 	/* Inform user we're ok so far */
 	printk(KERN_INFO "DMA: MPC52xx BestComm driver\n");
 
+	/* Get, reserve & map io */
+	regs = devm_platform_get_and_ioremap_resource(op, 0, &res_bcom);
+	if (IS_ERR(regs))
+		return PTR_ERR(regs);
+
 	/* Get the bestcomm node */
 	of_node_get(op->dev.of_node);

@@ -402,35 +407,13 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	/* Save the node */
 	bcom_eng->ofnode = op->dev.of_node;
 
-	/* Get, reserve & map io */
-	if (of_address_to_resource(op->dev.of_node, 0, &res_bcom)) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't get resource\n");
-		rv = -EINVAL;
-		goto error_sramclean;
-	}
-
-	if (!request_mem_region(res_bcom.start, resource_size(&res_bcom),
-				DRIVER_NAME)) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't request registers region\n");
-		rv = -EBUSY;
-		goto error_sramclean;
-	}
-
-	bcom_eng->regs_base = res_bcom.start;
-	bcom_eng->regs = ioremap(res_bcom.start, sizeof(struct mpc52xx_sdma));
-	if (!bcom_eng->regs) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't map registers\n");
-		rv = -ENOMEM;
-		goto error_release;
-	}
+	bcom_eng->regs = regs;
+	bcom_eng->regs_base = res_bcom->start;
 
 	/* Now, do the real init */
 	rv = bcom_engine_init();
 	if (rv)
-		goto error_unmap;
+		goto error_sramclean;
 
 	/* Done ! */
 	printk(KERN_INFO "DMA: MPC52xx BestComm engine @%08lx ok !\n",

@@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	return 0;
 
 	/* Error path */
-error_unmap:
-	iounmap(bcom_eng->regs);
-error_release:
-	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
 error_sramclean:
 	kfree(bcom_eng);
 	bcom_sram_cleanup();

@@ -463,10 +442,6 @@ static void mpc52xx_bcom_remove(struct platform_device *op)
 	/* Cleanup SRAM */
 	bcom_sram_cleanup();
 
-	/* Release regs */
-	iounmap(bcom_eng->regs);
-	release_mem_region(bcom_eng->regs_base, sizeof(struct mpc52xx_sdma));
-
 	/* Release the node */
 	of_node_put(bcom_eng->ofnode);

Signature · 1 line

2.55.0

[email protected]

AI review

2026-09-02 21:54 UTC #1 lore raw

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The globally exported bcom_eng pointer is freed but not nullified on the probe error path, leaving a dangling pointer. --

commit c9ef17db56df7b3bc923fc0c2ee2b7acf55e223b
Author: Rosen Penev <[email protected]>

dmaengine: bestcomm: ioremap early

This commit replaces the open-coded resource lookup and cleanup in the bestcomm driver probe and remove paths with the managed devm_platform_get_and_ioremap_resource() helper, simplifying error handling.

Quoted 4 lines

drivers/dma/bestcomm/bestcomm.c +0 -0
index 432b43520ddc9..44ff4a42376b1 100644

[ ... ]

drivers/dma/bestcomm/bestcomm.c static int mpc52xx_bcom_probe(struct platform_device *op) · line 426

Quoted 10 lines

drivers/dma/bestcomm/bestcomm.c +0 -4

@@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	return 0;
 
 	/* Error path */
-error_unmap:
-	iounmap(bcom_eng->regs);
-error_release:
-	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
 error_sramclean:
 	kfree(bcom_eng);

[Severity: High]
This isn't a bug introduced by this patch, but is it possible for the global bcom_eng pointer to be left dangling here?

On the error path when mpc52xx_bcom_probe() fails (e.g., if bcom_engine_init() returns an error), kfree(bcom_eng) is called but bcom_eng is not explicitly reset to NULL.

Could local system drivers (like those in drivers/net/ethernet/freescale/) calling exported functions such as bcom_task_alloc() bypass safety checks since bcom_eng is not NULL, and proceed to dereference freed memory (for instance, when attempting to acquire bcom_eng->lock)?

Quoted 1 line

drivers/dma/bestcomm/bestcomm.c +0 -0
 	bcom_sram_cleanup();

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Frank Li

2026-09-04 15:50 UTC #2 lore raw

In reply to Rosen Penev

On Wed, Sep 02, 2026 at 02:46:12PM -0700, Rosen Penev wrote:

subject: dmaengine: bestcomm: use devm_platform_get_and_ioremap_resource() to simplify code

Quoted 3 lines

ioremap early as devm_platform_get_and_ioremap_resource() only needs a platform_device pointer. Also avoid doing work before alllocating the main
struct.

needn't this paragraph.

Quoted 7 lines

Replace the open-coded resource lookup, request_mem_region, ioremap and the manual iounmap/release_mem_region cleanup in probe/remove with the managed devm_platform_get_and_ioremap_resource() helper. This removes the now-unused error-unmap/release paths and simplifies probing.
This also fixes a resource size mismatch between allocating and freeing

Fix a ...

Frank

Quoted 106 lines

where request_mem_region() and release_mem_region() hopefully use the same size but is not guarenteed.

Signed-off-by Rosen Penev <[email protected]>

---
v2: remove Sashiko generated description. Reword description.

 drivers/dma/bestcomm/bestcomm.c | 45 ++++++++-------------------------
 1 file changed, 10 insertions(+), 35 deletions(-)

drivers/dma/bestcomm/bestcomm.c +10 ~~-36~~

index 432b43520ddc..44ff4a42376b 100644
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/of.h>
-#include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/platform_device.h>
 #include <asm/io.h>

@@ -365,13 +364,19 @@ bcom_engine_cleanup(void)
 static int mpc52xx_bcom_probe(struct platform_device *op)
 {
 	struct device_node *ofn_sram;
-	struct resource res_bcom;
+	struct resource *res_bcom;
+	void __iomem *regs;
 
 	int rv;
 
 	/* Inform user we're ok so far */
 	printk(KERN_INFO "DMA: MPC52xx BestComm driver\n");
 
+	/* Get, reserve & map io */
+	regs = devm_platform_get_and_ioremap_resource(op, 0, &res_bcom);
+	if (IS_ERR(regs))
+		return PTR_ERR(regs);
+
 	/* Get the bestcomm node */
 	of_node_get(op->dev.of_node);

@@ -402,35 +407,13 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	/* Save the node */
 	bcom_eng->ofnode = op->dev.of_node;
 
-	/* Get, reserve & map io */
-	if (of_address_to_resource(op->dev.of_node, 0, &res_bcom)) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't get resource\n");
-		rv = -EINVAL;
-		goto error_sramclean;
-	}
-
-	if (!request_mem_region(res_bcom.start, resource_size(&res_bcom),
-				DRIVER_NAME)) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't request registers region\n");
-		rv = -EBUSY;
-		goto error_sramclean;
-	}
-
-	bcom_eng->regs_base = res_bcom.start;
-	bcom_eng->regs = ioremap(res_bcom.start, sizeof(struct mpc52xx_sdma));
-	if (!bcom_eng->regs) {
-		printk(KERN_ERR DRIVER_NAME ": "
-			"Can't map registers\n");
-		rv = -ENOMEM;
-		goto error_release;
-	}
+	bcom_eng->regs = regs;
+	bcom_eng->regs_base = res_bcom->start;
 
 	/* Now, do the real init */
 	rv = bcom_engine_init();
 	if (rv)
-		goto error_unmap;
+		goto error_sramclean;
 
 	/* Done ! */
 	printk(KERN_INFO "DMA: MPC52xx BestComm engine @%08lx ok !\n",

@@ -439,10 +422,6 @@ static int mpc52xx_bcom_probe(struct platform_device *op)
 	return 0;
 
 	/* Error path */
-error_unmap:
-	iounmap(bcom_eng->regs);
-error_release:
-	release_mem_region(res_bcom.start, sizeof(struct mpc52xx_sdma));
 error_sramclean:
 	kfree(bcom_eng);
 	bcom_sram_cleanup();

@@ -463,10 +442,6 @@ static void mpc52xx_bcom_remove(struct platform_device *op)
 	/* Cleanup SRAM */
 	bcom_sram_cleanup();
 
-	/* Release regs */
-	iounmap(bcom_eng->regs);
-	release_mem_region(bcom_eng->regs_base, sizeof(struct mpc52xx_sdma));
-
 	/* Release the node */
 	of_node_put(bcom_eng->ofnode);
 
--

2.55.0