[PATCH 00/13] Don't use GFP_DMA when calling dma_alloc_coherent

[PATCH 00/13] Don't use GFP_DMA when calling dma_alloc_coherent

[Baoquan He]

This series picks up the first part of an earlier cleanup series [1] that
was prepared back in the year of 2022, but for various reasons never made
it merged and has been sitting in a local tree since then. This subset
only touches the call sites where GFP_DMA is passed to dma_alloc_coherent()
(and its dma_alloc_wc()/dmam_alloc_coherent() variants), which is the most
self-contained and least risky slice of that work.

That GFP_DMA is simply redundant here: the DMA API derives the allocation
zone from the device's coherent_dma_mask (together with bus_dma_limit) and
ignores the GFP_DMA flag passed by the caller. 

Removing the redundant GFP_DMA won't harm anything, while keeps it from
being blindly copied into new code.

[1]
[PATCH 00/22] Don't use kmalloc() with GFP_DMA
https://lore.kernel.org/all/20220219005221.634-1-bhe@redhat.com/T/#u


Baoquan He (13):
  gpu: ipu-v3: Don't use GFP_DMA when calling dma_alloc_coherent()
  drm/sti: Don't use GFP_DMA when calling dma_alloc_wc()
  ALSA: n64: Don't use GFP_DMA when calling dma_alloc_coherent()
  spi: spi-ti-qspi: Don't use GFP_DMA when calling dma_alloc_coherent()
  fbdev: fsl-diu-fb: Don't use GFP_DMA when calling
    dmam_alloc_coherent()
  usb: gadget: lpc32xx_udc: Don't use GFP_DMA when calling
    dma_alloc_coherent()
  usb: cdns3: Don't use GFP_DMA when calling dma_alloc_coherent()
  media: staging: imx: Don't use GFP_DMA when calling
    dma_alloc_coherent()
  spi: atmel: Don't use GFP_DMA when calling dma_alloc_coherent()
  media: imx7-media-csi: Don't use GFP_DMA when calling
    dma_alloc_coherent()
  media: nxp: imx8-isi: Don't use GFP_DMA when calling
    dma_alloc_coherent()
  mtd: rawnand: gpmi: Don't use GFP_DMA when calling
    dma_alloc_coherent()
  usb: cdns2: Don't use GFP_DMA when calling dma_alloc_coherent()

 drivers/gpu/drm/sti/sti_cursor.c                     | 4 ++--
 drivers/gpu/drm/sti/sti_hqvdp.c                      | 2 +-
 drivers/gpu/ipu-v3/ipu-image-convert.c               | 2 +-
 drivers/media/platform/nxp/imx7-media-csi.c          | 2 +-
 drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c           | 2 +-
 drivers/spi/spi-atmel.c                              | 4 ++--
 drivers/spi/spi-ti-qspi.c                            | 2 +-
 drivers/staging/media/imx/imx-media-utils.c          | 2 +-
 drivers/usb/cdns3/cdns3-gadget.c                     | 2 +-
 drivers/usb/gadget/udc/cdns2/cdns2-gadget.c          | 2 +-
 drivers/usb/gadget/udc/lpc32xx_udc.c                 | 2 +-
 drivers/video/fbdev/fsl-diu-fb.c                     | 2 +-
 sound/mips/snd-n64.c                                 | 2 +-
 14 files changed, 16 insertions(+), 16 deletions(-)

-- 
2.54.0

[PATCH 01/13] gpu: ipu-v3: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/gpu/ipu-v3/ipu-image-convert.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
index 29b6d36c9bb6..493be4d4b091 100644
--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
@@ -371,7 +371,7 @@ static int alloc_dma_buf(struct ipu_image_convert_priv *priv,
 {
 	buf->len = PAGE_ALIGN(size);
 	buf->virt = dma_alloc_coherent(priv->ipu->dev, buf->len, &buf->phys,
-				       GFP_DMA | GFP_KERNEL);
+				       GFP_KERNEL);
 	if (!buf->virt) {
 		dev_err(priv->ipu->dev, "failed to alloc dma buffer\n");
 		return -ENOMEM;
-- 
2.54.0

[PATCH 02/13] drm/sti: Don't use GFP_DMA when calling dma_alloc_wc()

[Baoquan He]

dma_alloc_wc() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/gpu/drm/sti/sti_cursor.c | 4 ++--
 drivers/gpu/drm/sti/sti_hqvdp.c  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
index d0b89b28e50c..a0ec671477fd 100644
--- a/drivers/gpu/drm/sti/sti_cursor.c
+++ b/drivers/gpu/drm/sti/sti_cursor.c
@@ -240,7 +240,7 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
 		cursor->pixmap.base = dma_alloc_wc(cursor->dev,
 						   cursor->pixmap.size,
 						   &cursor->pixmap.paddr,
-						   GFP_KERNEL | GFP_DMA);
+						   GFP_KERNEL);
 		if (!cursor->pixmap.base) {
 			DRM_ERROR("Failed to allocate memory for pixmap\n");
 			return -EINVAL;
@@ -380,7 +380,7 @@ struct drm_plane *sti_cursor_create(struct drm_device *drm_dev,
 	/* Allocate clut buffer */
 	size = 0x100 * sizeof(unsigned short);
 	cursor->clut = dma_alloc_wc(dev, size, &cursor->clut_paddr,
-				    GFP_KERNEL | GFP_DMA);
+				    GFP_KERNEL);
 
 	if (!cursor->clut) {
 		DRM_ERROR("Failed to allocate memory for cursor clut\n");
diff --git a/drivers/gpu/drm/sti/sti_hqvdp.c b/drivers/gpu/drm/sti/sti_hqvdp.c
index cf1ed8a33b8e..b0d66834bcbe 100644
--- a/drivers/gpu/drm/sti/sti_hqvdp.c
+++ b/drivers/gpu/drm/sti/sti_hqvdp.c
@@ -860,7 +860,7 @@ static void sti_hqvdp_init(struct sti_hqvdp *hqvdp)
 	size = NB_VDP_CMD * sizeof(struct sti_hqvdp_cmd);
 	hqvdp->hqvdp_cmd = dma_alloc_wc(hqvdp->dev, size,
 					&dma_addr,
-					GFP_KERNEL | GFP_DMA);
+					GFP_KERNEL);
 	if (!hqvdp->hqvdp_cmd) {
 		DRM_ERROR("Failed to allocate memory for VDP cmd\n");
 		return;
-- 
2.54.0

Re: [PATCH 02/13] drm/sti: Don't use GFP_DMA when calling dma_alloc_wc()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The `sti_cursor_atomic_check` callback incorrectly mutates persistent global plane state and frees active DMA memory during the validation-only atomic check phase. This violates the DRM atomic API contract and causes a hardware use-after-free if triggered by a TEST_ONLY commit or if the commit fails.
- [High] Missing error handling for DMA allocation failure in `sti_hqvdp_init` leads to a NULL pointer dereference later in `sti_hqvdp_atomic_update`.
--

commit ffcf141c00928add2d88a408f8402ffc52667925
Author: Baoquan He <hebaoquan@kylinos.cn>
drm/sti: Don't use GFP_DMA when calling dma_alloc_wc()

This commit removes the redundant GFP_DMA flag from dma_alloc_wc() calls
in the sti DRM driver, as the DMA core already handles zone selection based
on the device's coherent DMA mask.

> diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c
> --- a/drivers/gpu/drm/sti/sti_cursor.c
> +++ b/drivers/gpu/drm/sti/sti_cursor.c
[ ... ]
> @@ -240,7 +240,7 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane,
>  		cursor->pixmap.base = dma_alloc_wc(cursor->dev,
>  						   cursor->pixmap.size,
>  						   &cursor->pixmap.paddr,
> -						   GFP_KERNEL | GFP_DMA);
> +						   GFP_KERNEL);
>  		if (!cursor->pixmap.base) {
>  			DRM_ERROR("Failed to allocate memory for pixmap\n");
>  			return -EINVAL;

[Severity: Critical]
This is a pre-existing issue, but does this mutate persistent global plane
state during the validation-only atomic check phase?

Just before this allocation, sti_cursor_atomic_check() frees the active
DMA buffer (cursor->pixmap.base). Could this cause a hardware use-after-free
if triggered by a TEST_ONLY commit while the hardware is still scanning out
the old buffer? It appears the mutation of global state here breaks the core
assumption that TEST_ONLY commits are side-effect free.

[ ... ]
> diff --git a/drivers/gpu/drm/sti/sti_hqvdp.c b/drivers/gpu/drm/sti/sti_hqvdp.c
> --- a/drivers/gpu/drm/sti/sti_hqvdp.c
> +++ b/drivers/gpu/drm/sti/sti_hqvdp.c
[ ... ]
> @@ -860,7 +860,7 @@ static void sti_hqvdp_init(struct sti_hqvdp *hqvdp)
>  	size = NB_VDP_CMD * sizeof(struct sti_hqvdp_cmd);
>  	hqvdp->hqvdp_cmd = dma_alloc_wc(hqvdp->dev, size,
>  					&dma_addr,
> -					GFP_KERNEL | GFP_DMA);
> +					GFP_KERNEL);
>  	if (!hqvdp->hqvdp_cmd) {
>  		DRM_ERROR("Failed to allocate memory for VDP cmd\n");
>  		return;
>  	}

[Severity: High]
This is a pre-existing issue, but should this function return an error code
if the allocation fails instead of just returning void?

If dma_alloc_wc() fails here in sti_hqvdp_init(), the error is logged but
not propagated to the caller, leaving hqvdp->hqvdp_cmd as NULL. Could this
allow the plane to be successfully registered, resulting in a NULL pointer
dereference later when userspace attempts to use the plane?

For example, sti_hqvdp_atomic_update() dereferences the pointer
unconditionally:

sti_hqvdp_atomic_update()
   cmd = hqvdp->hqvdp_cmd + cmd_offset;
   cmd->top.config = TOP_CONFIG_PROGRESSIVE;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=2

[PATCH 03/13] ALSA: n64: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: linux-sound@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 sound/mips/snd-n64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/mips/snd-n64.c b/sound/mips/snd-n64.c
index f17e63f2ff5a..e2cf9df15d48 100644
--- a/sound/mips/snd-n64.c
+++ b/sound/mips/snd-n64.c
@@ -298,7 +298,7 @@ static int __init n64audio_probe(struct platform_device *pdev)
 	priv->card = card;
 
 	priv->ring_base = dma_alloc_coherent(card->dev, 32 * 1024, &priv->ring_base_dma,
-					     GFP_DMA|GFP_KERNEL);
+					     GFP_KERNEL);
 	if (!priv->ring_base) {
 		err = -ENOMEM;
 		goto fail_card;
-- 
2.54.0

[PATCH 04/13] spi: spi-ti-qspi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: linux-spi@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/spi/spi-ti-qspi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 34b154922ff2..fb0d940883fb 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -855,7 +855,7 @@ static int ti_qspi_probe(struct platform_device *pdev)
 	qspi->rx_bb_addr = dma_alloc_coherent(qspi->dev,
 					      QSPI_DMA_BUFFER_SIZE,
 					      &qspi->rx_bb_dma_addr,
-					      GFP_KERNEL | GFP_DMA);
+					      GFP_KERNEL);
 	if (!qspi->rx_bb_addr) {
 		dev_err(qspi->dev,
 			"dma_alloc_coherent failed, using PIO mode\n");
-- 
2.54.0

[PATCH 05/13] fbdev: fsl-diu-fb: Don't use GFP_DMA when calling dmam_alloc_coherent()

[Baoquan He]

dmam_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: dri-devel@lists.freedesktop.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/video/fbdev/fsl-diu-fb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
index b71d15794ce8..d7ed007915c1 100644
--- a/drivers/video/fbdev/fsl-diu-fb.c
+++ b/drivers/video/fbdev/fsl-diu-fb.c
@@ -1690,7 +1690,7 @@ static int fsl_diu_probe(struct platform_device *pdev)
 	int ret;
 
 	data = dmam_alloc_coherent(&pdev->dev, sizeof(struct fsl_diu_data),
-				   &dma_addr, GFP_DMA | __GFP_ZERO);
+				   &dma_addr, __GFP_ZERO);
 	if (!data)
 		return -ENOMEM;
 	data->dma_addr = dma_addr;
-- 
2.54.0

Re: [PATCH 05/13] fbdev: fsl-diu-fb: Don't use GFP_DMA when calling dmam_alloc_coherent()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `GFP_KERNEL` (or other `__GFP_RECLAIM` bits) in memory allocations, causing large allocations to act as non-blocking `GFP_NOWAIT` atomic allocations which are highly prone to failure.
- [High] Video memory is freed while the LCDC hardware is still performing DMA reads from it, and error paths can leave the hardware permanently reading freed memory.
- [High] Concurrent mode setting can lead to a double free of video memory because sysfs accesses do not take the necessary locks.
- [High] The struct fb_info is embedded in a devres-managed structure, leading to a Use-After-Free if a process holds the device open during unbind.
--

commit 719f5155a18f433533c0efd3851ce4c2f8cf3732
Author: Baoquan He <hebaoquan@kylinos.cn>
fbdev: fsl-diu-fb: Don't use GFP_DMA when calling dmam_alloc_coherent()

This commit removes the redundant GFP_DMA flag from the dmam_alloc_coherent()
call in fsl_diu_probe(), as the DMA core ignores it and picks the zone from
the device's coherent DMA mask.

> diff --git a/drivers/video/fbdev/fsl-diu-fb.c b/drivers/video/fbdev/fsl-diu-fb.c
> index b71d15794ce8b..d7ed007915c18 100644
> --- a/drivers/video/fbdev/fsl-diu-fb.c
> +++ b/drivers/video/fbdev/fsl-diu-fb.c
> @@ -1690,7 +1690,7 @@ static int fsl_diu_probe(struct platform_device *pdev)
>  	int ret;
>  
>  	data = dmam_alloc_coherent(&pdev->dev, sizeof(struct fsl_diu_data),
> -				   &dma_addr, GFP_DMA | __GFP_ZERO);
> +				   &dma_addr, __GFP_ZERO);

[Severity: High]
This isn't a bug introduced by this patch, but removing the redundant flag
highlights that this allocation lacks GFP_KERNEL (and thus __GFP_RECLAIM
bits). Does this multi-page allocation for the driver data structure act as
an atomic non-blocking allocation because it lacks GFP_KERNEL, making it
highly prone to failure?

The same pattern appears in map_video_memory(), where a massive multi-megabyte
framebuffer allocation is requested:

drivers/video/fbdev/fsl-diu-fb.c:map_video_memory() {
    ...
    p = alloc_pages_exact(smem_len, GFP_DMA | __GFP_ZERO);
    ...
}

Could this lack of GFP_KERNEL cause these large allocations to fail during
uptime mode setting via ioctl(FBIOPUT_VSCREENINFO) due to fragmentation?

[Severity: High]
This is a pre-existing issue, but does using a devres-managed lifecycle for
struct fsl_diu_data bypass the reference counting required by the framebuffer
core?

The data pointer returned by dmam_alloc_coherent() contains an array of
fb_info structures:

drivers/video/fbdev/fsl-diu-fb.c:fsl_diu_probe() {
    ...
    for (i = 0; i < NUM_AOIS; i++) {
        struct fb_info *info = &data->fsl_diu_info[i];
    ...
}

If a user process holds /dev/fb0 open during driver unbind, the driver core
will free struct fsl_diu_data upon return from fsl_diu_remove(). Will this
lead to a use-after-free when the process subsequently closes the descriptor
and VFS calls into fbmem.c to access the already-freed fb_info struct?

[Severity: High]
This is a pre-existing issue, but could fsl_diu_set_par() leave the LCDC
hardware permanently reading freed memory?

drivers/video/fbdev/fsl-diu-fb.c:fsl_diu_set_par() {
        ...
        if (info->fix.smem_start)
            unmap_video_memory(info);

        /* Memory allocation for framebuffer */
        if (map_video_memory(info)) {
            fb_err(info, "unable to allocate fb memory 1\n");
            return -ENOMEM;
        }
        ...
}

Since unmap_video_memory() frees the active display buffer pages via
free_pages_exact() before the hardware is disabled, the hardware continues
fetching from these physical addresses. If map_video_memory() fails (which
is highly likely due to missing GFP_KERNEL), it returns -ENOMEM early. Does
this mean the hardware is never stopped and its DMA descriptor is never
updated, persistently leaking the contents of arbitrary newly-allocated kernel
pages to the screen?

[Severity: High]
This is a pre-existing issue, but can concurrent mode setting lead to a
double free of video memory?

In store_monitor(), fsl_diu_set_par() is called locklessly:

drivers/video/fbdev/fsl-diu-fb.c:store_monitor() {
        ...
        for (i=0; i < NUM_AOIS; i++)
            fsl_diu_set_par(&data->fsl_diu_info[i]);
        ...
}

If ioctl(FBIOPUT_VSCREENINFO) concurrently updates info->var and calls
fb_set_par() (holding info->lock), both threads could simultaneously evaluate
len != info->fix.smem_len as true and call unmap_video_memory().

Inside unmap_video_memory():

drivers/video/fbdev/fsl-diu-fb.c:unmap_video_memory() {
    ...
    void *p = info->screen_base;
    size_t l = info->fix.smem_len;

    mutex_lock(&info->mm_lock);
    info->screen_base = NULL;
    info->fix.smem_start = 0;
    info->fix.smem_len = 0;
    mutex_unlock(&info->mm_lock);

    if (p)
        free_pages_exact(p, l);
    ...
}

Since the pointer p = info->screen_base is read outside the lock, couldn't
both racing threads capture the same pointer, clear the base inside the lock
sequentially, and then unconditionally execute a double free on the identical
pointer?

>  	if (!data)
>  		return -ENOMEM;
>  	data->dma_addr = dma_addr;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=5

[PATCH 06/13] usb: gadget: lpc32xx_udc: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: linux-usb@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/usb/gadget/udc/lpc32xx_udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
index 044c31869cfb..90d1eef52877 100644
--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
@@ -3080,7 +3080,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 	/* Allocate memory for the UDCA */
 	udc->udca_v_base = dma_alloc_coherent(&pdev->dev, UDCA_BUFF_SIZE,
 					      &dma_handle,
-					      (GFP_KERNEL | GFP_DMA));
+					      GFP_KERNEL);
 	if (!udc->udca_v_base) {
 		dev_err(udc->dev, "error getting UDCA region\n");
 		retval = -ENOMEM;
-- 
2.54.0

[PATCH 07/13] usb: cdns3: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Use GFP_KERNEL instead so the allocation may reclaim as usual for
probe-time allocations.

Cc: linux-usb@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/usb/cdns3/cdns3-gadget.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index 42311c1bfada..484d3128cf08 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -3376,7 +3376,7 @@ static int cdns3_gadget_start(struct cdns *cdns)
 
 	/* allocate memory for setup packet buffer */
 	priv_dev->setup_buf = dma_alloc_coherent(priv_dev->sysdev, 8,
-						 &priv_dev->setup_dma, GFP_DMA);
+						 &priv_dev->setup_dma, GFP_KERNEL);
 	if (!priv_dev->setup_buf) {
 		ret = -ENOMEM;
 		goto err2;
-- 
2.54.0

[PATCH 08/13] media: staging: imx: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: linux-staging@lists.linux.dev
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/staging/media/imx/imx-media-utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/imx/imx-media-utils.c b/drivers/staging/media/imx/imx-media-utils.c
index f119477cac6b..7bdcb88a686b 100644
--- a/drivers/staging/media/imx/imx-media-utils.c
+++ b/drivers/staging/media/imx/imx-media-utils.c
@@ -588,7 +588,7 @@ int imx_media_alloc_dma_buf(struct device *dev,
 
 	buf->len = PAGE_ALIGN(size);
 	buf->virt = dma_alloc_coherent(dev, buf->len, &buf->phys,
-				       GFP_DMA | GFP_KERNEL);
+				       GFP_KERNEL);
 	if (!buf->virt)
 		return -ENOMEM;
 
-- 
2.54.0

[PATCH 09/13] spi: atmel: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: linux-spi@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/spi/spi-atmel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index c8012c82c3a7..e91e84fdbe8f 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -624,7 +624,7 @@ static int atmel_spi_configure_dma(struct spi_controller *host,
 	if (IS_ENABLED(CONFIG_SOC_SAM_V4_V5)) {
 		as->addr_tx_bbuf = dma_alloc_coherent(dev, SPI_MAX_DMA_XFER,
 						      &as->dma_addr_tx_bbuf,
-						      GFP_KERNEL | GFP_DMA);
+						      GFP_KERNEL);
 		if (!as->addr_tx_bbuf) {
 			err = -ENOMEM;
 			goto err_release_dma;
@@ -632,7 +632,7 @@ static int atmel_spi_configure_dma(struct spi_controller *host,
 
 		as->addr_rx_bbuf = dma_alloc_coherent(dev, SPI_MAX_DMA_XFER,
 						      &as->dma_addr_rx_bbuf,
-						      GFP_KERNEL | GFP_DMA);
+						      GFP_KERNEL);
 		if (!as->addr_rx_bbuf) {
 			err = -ENOMEM;
 			goto err_release_dma;
-- 
2.54.0

[PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: imx@lists.linux.dev
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/media/platform/nxp/imx7-media-csi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
index 7ddc7ba06e3d..22c0cbdc92bf 100644
--- a/drivers/media/platform/nxp/imx7-media-csi.c
+++ b/drivers/media/platform/nxp/imx7-media-csi.c
@@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
 
 	buf->len = PAGE_ALIGN(size);
 	buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
-				       GFP_DMA | GFP_KERNEL);
+				       GFP_KERNEL);
 	if (!buf->virt)
 		return -ENOMEM;
 
-- 
2.54.0

Re: [PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Integer overflow in `sizeimage` calculation and signedness truncation in `imx7_csi_alloc_dma_buf()` allow userspace to trigger a massive out-of-bounds DMA write, corrupting kernel memory.
--

commit 007baffc77bd7059db343099782a06610465cf12
Author: Baoquan He <hebaoquan@kylinos.cn>
Subject: media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

This commit removes the redundant GFP_DMA flag from the dma_alloc_coherent()
call in imx7_csi_alloc_dma_buf(). The DMA core already handles device
addressing limitations and ignores GFP_DMA.

> diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
> index 7ddc7ba06e3d4..22c0cbdc92bfb 100644
> --- a/drivers/media/platform/nxp/imx7-media-csi.c
> +++ b/drivers/media/platform/nxp/imx7-media-csi.c
> @@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
>  
>  	buf->len = PAGE_ALIGN(size);
>  	buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
> -				       GFP_DMA | GFP_KERNEL);
> +				       GFP_KERNEL);
[Severity: Critical]
This isn't a bug introduced by this patch, but could this allocation lead to
arbitrary kernel memory corruption?

The size parameter in imx7_csi_alloc_dma_buf() is a signed int. This allows
large unsigned 32-bit sizeimage values (e.g., between 2 GB and 4 GB) to be
interpreted as negative, subverting the PAGE_ALIGN macro.

This seems to be reachable from userspace because imx7_csi_try_fmt() lacks
bounds checking for width and height in the IMX7_CSI_PAD_SINK case:

drivers/media/platform/nxp/imx7-media-csi.c:imx7_csi_try_fmt() {
    ...
    case IMX7_CSI_PAD_SINK:
        *cc = imx7_csi_find_mbus_format(sdformat->format.code);
    ...
}

This allows massive dimensions to bypass validation. When passed to
__imx7_csi_video_try_fmt(), the 32-bit multiplication overflows without
prior bounds checking on the total pixel volume:

drivers/media/platform/nxp/imx7-media-csi.c:__imx7_csi_video_try_fmt() {
    ...
    pixfmt->sizeimage = pixfmt->bytesperline * pixfmt->height;
    ...
}

If a user calls VIDIOC_S_FMT with large dimensions (e.g., width=32896,
height=65281, and a 16-bpp format), the product wraps around modulo 2^32,
producing a very small positive sizeimage, or a negative size when passed
as a signed int to imx7_csi_alloc_dma_buf().

As a result, a tiny buffer is allocated here, but the CSI hardware could
capture the massive frame and DMA up to 4 GB of data into it, seamlessly
crossing the buffer boundary.

>  	if (!buf->virt)
>  		return -ENOMEM;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=10

Re: [PATCH 10/13] media: imx7-media-csi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Frank Li]

On Thu, Sep 03, 2026 at 07:18:33PM +0800, Baoquan He wrote:
> [You don't often get email from hebaoquan@kylinos.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> dma_alloc_coherent() allocates the DMA buffer with the device's
> addressing limitation in mind; the DMA core picks the zone from the
> device's coherent DMA mask and ignores GFP_DMA passed by the caller.
> Remove the redundant GFP_DMA flag.
>
> Cc: imx@lists.linux.dev
> Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/media/platform/nxp/imx7-media-csi.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c
> index 7ddc7ba06e3d..22c0cbdc92bf 100644
> --- a/drivers/media/platform/nxp/imx7-media-csi.c
> +++ b/drivers/media/platform/nxp/imx7-media-csi.c
> @@ -466,7 +466,7 @@ static int imx7_csi_alloc_dma_buf(struct imx7_csi *csi,
>
>         buf->len = PAGE_ALIGN(size);
>         buf->virt = dma_alloc_coherent(csi->dev, buf->len, &buf->dma_addr,
> -                                      GFP_DMA | GFP_KERNEL);
> +                                      GFP_KERNEL);
>         if (!buf->virt)
>                 return -ENOMEM;
>
> --
> 2.54.0
>
>

[PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Remove the redundant GFP_DMA flag.

Cc: imx@lists.linux.dev
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
index f45c2aae59ce..fc907d357149 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
@@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
 
 		buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
 		buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
-					       &buf->dma, GFP_DMA | GFP_KERNEL);
+					       &buf->dma, GFP_KERNEL);
 		if (!buf->addr) {
 			mxc_isi_video_free_discard_buffers(video);
 			return -ENOMEM;
-- 
2.54.0

Re: [PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Teardown symmetry violation in `mxc_isi_remove()` causing a NULL pointer dereference / Use-After-Free.
--

commit 846491721093e7e929fd40da0be5709669dc9e9f
Author: Baoquan He <hebaoquan@kylinos.cn>

media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind. The DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
This commit removes the redundant GFP_DMA flag.

> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> index f45c2aae59ce9..fc907d357149e 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> @@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
>  
>  		buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
>  		buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
> -					       &buf->dma, GFP_DMA | GFP_KERNEL);
> +					       &buf->dma, GFP_KERNEL);
>  		if (!buf->addr) {
>  			mxc_isi_video_free_discard_buffers(video);
>  			return -ENOMEM;

[Severity: High]
This isn't a bug introduced by this patch, but looking at the teardown
sequence in drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:

drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:mxc_isi_remove() {
	...
	for (i = 0; i < isi->pdata->num_channels; ++i) {
		struct mxc_isi_pipe *pipe = &isi->pipes[i];

		mxc_isi_pipe_cleanup(pipe);
	}

	mxc_isi_v4l2_cleanup(isi);
	...
}

Does this code have a teardown symmetry violation causing a use-after-free or
NULL pointer dereference?

mxc_isi_pipe_cleanup(pipe) is called before mxc_isi_v4l2_cleanup(isi), freeing
the subdevice active state and setting it to NULL before the user-space
interfaces are unregistered.

Because mxc_isi_v4l2_cleanup() has not yet run, the video device nodes are
still fully registered.

Could a concurrent ioctl from user-space, such as VIDIOC_STREAMON, call
mxc_isi_vb2_prepare_streaming() -> mxc_isi_pipe_acquire() ->
v4l2_subdev_lock_and_get_active_state() and dereference the now-NULL
active_state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903111836.1777265-1-hebaoquan@kylinos.cn?part=11

Re: [PATCH 11/13] media: nxp: imx8-isi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Frank Li]

On Thu, Sep 03, 2026 at 07:18:34PM +0800, Baoquan He wrote:
> [You don't often get email from hebaoquan@kylinos.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> dma_alloc_coherent() allocates the DMA buffer with the device's
> addressing limitation in mind; the DMA core picks the zone from the
> device's coherent DMA mask and ignores GFP_DMA passed by the caller.
> Remove the redundant GFP_DMA flag.
>
> Cc: imx@lists.linux.dev
> Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> index f45c2aae59ce..fc907d357149 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
> @@ -773,7 +773,7 @@ static int mxc_isi_video_alloc_discard_buffers(struct mxc_isi_video *video)
>
>                 buf->size = PAGE_ALIGN(video->pix.plane_fmt[i].sizeimage);
>                 buf->addr = dma_alloc_coherent(video->pipe->isi->dev, buf->size,
> -                                              &buf->dma, GFP_DMA | GFP_KERNEL);
> +                                              &buf->dma, GFP_KERNEL);
>                 if (!buf->addr) {
>                         mxc_isi_video_free_discard_buffers(video);
>                         return -ENOMEM;
> --
> 2.54.0
>
>

[PATCH 12/13] mtd: rawnand: gpmi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Use GFP_KERNEL instead so the allocation may reclaim as usual for
probe-time allocations.

Cc: linux-mtd@lists.infradead.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 527165ccc839..0d91950ae9fd 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -1387,7 +1387,7 @@ static int gpmi_alloc_dma_buffer(struct gpmi_nand_data *this)
 		goto error_alloc;
 
 	this->auxiliary_virt = dma_alloc_coherent(dev, geo->auxiliary_size,
-					&this->auxiliary_phys, GFP_DMA);
+					&this->auxiliary_phys, GFP_KERNEL);
 	if (!this->auxiliary_virt)
 		goto error_alloc;
 
-- 
2.54.0

[PATCH 12/13] mtd: rawnand: gpmi: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Use GFP_KERNEL instead so the allocation may reclaim as usual for
probe-time allocations.

Cc: linux-mtd@lists.infradead.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 527165ccc839..0d91950ae9fd 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -1387,7 +1387,7 @@ static int gpmi_alloc_dma_buffer(struct gpmi_nand_data *this)
 		goto error_alloc;
 
 	this->auxiliary_virt = dma_alloc_coherent(dev, geo->auxiliary_size,
-					&this->auxiliary_phys, GFP_DMA);
+					&this->auxiliary_phys, GFP_KERNEL);
 	if (!this->auxiliary_virt)
 		goto error_alloc;
 
-- 
2.54.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 13/13] usb: cdns2: Don't use GFP_DMA when calling dma_alloc_coherent()

[Baoquan He]

dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Use GFP_KERNEL instead so the allocation may reclaim as usual for
probe-time allocations.

Cc: linux-usb@vger.kernel.org
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
---
 drivers/usb/gadget/udc/cdns2/cdns2-gadget.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
index 308d3c468ab1..8719f1f86e61 100644
--- a/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
+++ b/drivers/usb/gadget/udc/cdns2/cdns2-gadget.c
@@ -2341,7 +2341,7 @@ static int cdns2_gadget_start(struct cdns2_device *pdev)
 
 	/* Allocate memory for setup packet buffer. */
 	buf = dma_alloc_coherent(pdev->dev, 8, &pdev->ep0_preq.request.dma,
-				 GFP_DMA);
+				 GFP_KERNEL);
 	pdev->ep0_preq.request.buf = buf;
 
 	if (!pdev->ep0_preq.request.buf) {
-- 
2.54.0