[PATCH] dmaengine: sprd-dma: handle runtime PM get failure

[PATCH] dmaengine: sprd-dma: handle runtime PM get failure

[Jiawen Liu]

From: jiawen <1298662399@qq.com>

Route failed runtime-PM acquisition through its existing cleanup path.

Release and disable runtime PM before continuing with the hardware
teardown, so an unsuccessful pm_runtime_get_sync() does not leave
runtime PM enabled.

Signed-off-by: jiawen <1298662399@qq.com>
---
diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -1212,7 +1212,7 @@
 
 	ret = pm_runtime_get_sync(&pdev->dev);
 	if (ret < 0)
-		goto err_rpm;
+		goto err_register;
 
 	ret = dma_async_device_register(&sdev->dma_dev);
 	if (ret < 0) {
@@ -1234,7 +1234,6 @@
 err_register:
 	pm_runtime_put_noidle(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
-err_rpm:
 	sprd_dma_disable(sdev);
 	return ret;
 }

Re: [PATCH] dmaengine: sprd-dma: handle runtime PM get failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] IRQ handler is registered before IO memory is mapped and virtual channels are initialized.
--

--- Patch [1]: [PATCH] dmaengine: sprd-dma: handle runtime PM get failure ---
commit 7b4114d448d81c577f92d85ac8c943dc9f9107c9
Author: jiawen <1298662399@qq.com>

dmaengine: sprd-dma: handle runtime PM get failure

Route failed runtime-PM acquisition through its existing cleanup path.

Release and disable runtime PM before continuing with the hardware
teardown, so an unsuccessful pm_runtime_get_sync() does not leave
runtime PM enabled.

> diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
> index 087fea3af2e41..19b32a23c882d 100644
> --- a/drivers/dma/sprd-dma.c
> +++ b/drivers/dma/sprd-dma.c
> @@ -1212,7 +1212,7 @@ static int sprd_dma_probe(struct platform_device *pdev)
>  
>  	ret = pm_runtime_get_sync(&pdev->dev);

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a pre-existing
issue earlier in sprd_dma_probe() where the IRQ handler is registered
before sdev->glb_base is mapped:

    ret = devm_request_irq(&pdev->dev, sdev->irq, dma_irq_handle,
                   0, "sprd_dma", (void *)sdev);
    ...
    sdev->glb_base = devm_platform_ioremap_resource(pdev, 0);

If an interrupt is pending from a previous kernel (e.g. kexec) or a
bootloader, the unmasked interrupt could cause dma_irq_handle() to
execute immediately.

Because the handler attempts to read from glb_base:

    u32 irq_status = readl(sdev->glb_base + SPRD_DMA_GLB_INT_MSK_STS);

could this cause a NULL pointer dereference and subsequent kernel panic
if the hardware asserts an interrupt before initialization completes?

>  	if (ret < 0)
> -		goto err_rpm;
> +		goto err_register;
>  
>  	ret = dma_async_device_register(&sdev->dma_dev);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_72CAD47A90A208C873DD65A726C0A15FC107@qq.com?part=1