[lkml]   [2021]   [Feb]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] dmaengine: ti: k3-udma: Fix NULL pointer dereference error
Hi Kishon,

On 2/9/21 2:45 PM, Kishon Vijay Abraham I wrote:
> Hi Peter,
> On 09/02/21 5:53 pm, Péter Ujfalusi wrote:
>> Hi Kishon,
>> On 2/9/21 11:00 AM, Kishon Vijay Abraham I wrote:
>>> bcdma_get_*() and udma_get_*() checks if bchan/rchan/tchan/rflow is
>>> already allocated by checking if it has a NON NULL value. For the
>>> error cases, bchan/rchan/tchan/rflow will have error value
>>> and bcdma_get_*() and udma_get_*() considers this as already allocated
>>> (PASS) since the error values are NON NULL. This results in
>>> NULL pointer dereference error while de-referencing
>>> bchan/rchan/tchan/rflow.
>> I think this can happen when a channel request fails and we get a second
>> request coming and faces with the not cleanup up tchan/rchan/bchan/rflow
>> from the previous failure.
>> Interesting that I have not faced with this, but it is a valid oversight
>> from me.
> Thank you for reviewing.
> Got into this issue when all the PCIe endpoint functions were requesting
> for a MEMCOPY channel (total 22 endpoint functions) specifically in
> bcdma_get_bchan() where the scenario you mentioned above happened.

I see, do we even have 22 bchan allocated for Linux out from the 40? ;)

> Vignesh asked me to fix it for all udma_get_*().

Yes, that is the right thing to do, thank you!

>>> Reset the value of bchan/rchan/tchan/rflow to NULL if the allocation
>>> actually fails.
>>> Fixes: 017794739702 ("dmaengine: ti: k3-udma: Initial support for K3 BCDMA")
>>> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
>> Will this patch apply at any of these?
>> 25dcb5dd7b7c does not have BCDMA (bchan)
>> 017794739702 does not contain PKTDMA (tflow)
> I can probably split this patch
> 017794739702 for bchan and 25dcb5dd7b7c for bchan/rchan/tchan/rflow

the tflow support for PKTDMA makes the tchan fix a bit problematic for
backporting, but it might worth a try to split to bcdma and
rchan/tchan/rflow patch.


 \ /
  Last update: 2021-02-10 08:52    [W:0.101 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site