Check the return value of dma_async_device_register() in the probe path and propagate errors instead of silently returning success. Previously, a registration failure would cause a NULL pointer dereference in list_del_rcu() during remove when dma_async_device_unregister() tried to remove the device's global_node from a list it was never added to.
Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <[email protected]> --- drivers/dma/fsldma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c index 0e2f84862261..89b88447be1b 100644 --- a/drivers/dma/fsldma.c +++ b/drivers/dma/fsldma.c @@ -1293,7 +1293,11 @@ static int fsldma_of_probe(struct platform_device *op) goto out_free_fdev; } - dma_async_device_register(&fdev->common); + err = dma_async_device_register(&fdev->common); + if (err) { + dev_err(fdev->dev, "unable to register DMA device\n"); + goto out_free_fdev; + } return 0; out_free_fdev: -- 2.54.0
