| Message ID | 20211027055254.10912-1-kishon@ti.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5c6c6d60e4b489308ae4da8424c869f7cc53cd12 |
| Headers | show |
| Series | [1/2] dmaengine: ti: k3-udma: Fix NULL pointer dereference error for BCDMA | expand |
Hi All, On 27/10/21 11:22 am, Kishon Vijay Abraham I wrote: > bcdma_get_*() checks if bchan is already allocated by checking if it > has a NON NULL value. For the error cases, bchan will have error value > and bcdma_get_*() considers this as already allocated (PASS) since the > error values are NON NULL. This results in NULL pointer dereference > error while de-referencing bchan. > > Reset the value of bchan to NULL if the allocation actually fails. > > Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Please ignore this series. There was some stray patches left which I failed to notice before sending. I'll resend a clean one. Thanks, Kishon > --- > drivers/dma/ti/k3-udma.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c > index a35858610780..14ae28830871 100644 > --- a/drivers/dma/ti/k3-udma.c > +++ b/drivers/dma/ti/k3-udma.c > @@ -1348,6 +1348,7 @@ static int bcdma_get_bchan(struct udma_chan *uc) > { > struct udma_dev *ud = uc->ud; > enum udma_tp_level tpl; > + int ret; > > if (uc->bchan) { > dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n", > @@ -1365,8 +1366,11 @@ static int bcdma_get_bchan(struct udma_chan *uc) > tpl = ud->bchan_tpl.levels - 1; > > uc->bchan = __udma_reserve_bchan(ud, tpl, -1); > - if (IS_ERR(uc->bchan)) > - return PTR_ERR(uc->bchan); > + if (IS_ERR(uc->bchan)) { > + ret = PTR_ERR(uc->bchan); > + uc->bchan = NULL; > + return ret; > + } > > uc->tchan = uc->bchan; > >
diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index a35858610780..14ae28830871 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -1348,6 +1348,7 @@ static int bcdma_get_bchan(struct udma_chan *uc) { struct udma_dev *ud = uc->ud; enum udma_tp_level tpl; + int ret; if (uc->bchan) { dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n", @@ -1365,8 +1366,11 @@ static int bcdma_get_bchan(struct udma_chan *uc) tpl = ud->bchan_tpl.levels - 1; uc->bchan = __udma_reserve_bchan(ud, tpl, -1); - if (IS_ERR(uc->bchan)) - return PTR_ERR(uc->bchan); + if (IS_ERR(uc->bchan)) { + ret = PTR_ERR(uc->bchan); + uc->bchan = NULL; + return ret; + } uc->tchan = uc->bchan;
bcdma_get_*() checks if bchan is already allocated by checking if it has a NON NULL value. For the error cases, bchan will have error value and bcdma_get_*() considers this as already allocated (PASS) since the error values are NON NULL. This results in NULL pointer dereference error while de-referencing bchan. Reset the value of bchan to NULL if the allocation actually fails. Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> --- drivers/dma/ti/k3-udma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)