From: "Péter Ujfalusi" <peter.ujfalusi@gmail.com>
To: Kishon Vijay Abraham I <kishon@ti.com>,
Dan Williams <dan.j.williams@intel.com>,
Vinod Koul <vkoul@kernel.org>,
Grygorii Strashko <grygorii.strashko@ti.com>,
Vignesh Raghavendra <vigneshr@ti.com>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] dmaengine: ti: k3-udma: Fix NULL pointer dereference error
Date: Wed, 10 Feb 2021 09:50:38 +0200 [thread overview]
Message-ID: <35a0a9a0-e938-da54-a500-624b2b6fcdeb@gmail.com> (raw)
In-Reply-To: <7e06c63d-606b-be78-84ff-d5a5c72f7ad7@ti.com>
Hi Kishon,
On 2/9/21 2:45 PM, Kishon Vijay Abraham I wrote:
> Hi Peter,
>
> On 09/02/21 5:53 pm, Péter Ujfalusi wrote:
>> Hi Kishon,
>>
>> On 2/9/21 11:00 AM, Kishon Vijay Abraham I wrote:
>>> bcdma_get_*() and udma_get_*() checks if bchan/rchan/tchan/rflow is
>>> already allocated by checking if it has a NON NULL value. For the
>>> error cases, bchan/rchan/tchan/rflow will have error value
>>> and bcdma_get_*() and udma_get_*() considers this as already allocated
>>> (PASS) since the error values are NON NULL. This results in
>>> NULL pointer dereference error while de-referencing
>>> bchan/rchan/tchan/rflow.
>>
>> I think this can happen when a channel request fails and we get a second
>> request coming and faces with the not cleanup up tchan/rchan/bchan/rflow
>> from the previous failure.
>> Interesting that I have not faced with this, but it is a valid oversight
>> from me.
>
> Thank you for reviewing.
>
> Got into this issue when all the PCIe endpoint functions were requesting
> for a MEMCOPY channel (total 22 endpoint functions) specifically in
> bcdma_get_bchan() where the scenario you mentioned above happened.
I see, do we even have 22 bchan allocated for Linux out from the 40? ;)
> Vignesh asked me to fix it for all udma_get_*().
Yes, that is the right thing to do, thank you!
>>
>>> Reset the value of bchan/rchan/tchan/rflow to NULL if the allocation
>>> actually fails.
>>>
>>> Fixes: 017794739702 ("dmaengine: ti: k3-udma: Initial support for K3 BCDMA")
>>> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
>>
>> Will this patch apply at any of these?
>> 25dcb5dd7b7c does not have BCDMA (bchan)
>> 017794739702 does not contain PKTDMA (tflow)
>
> I can probably split this patch
> 017794739702 for bchan and 25dcb5dd7b7c for bchan/rchan/tchan/rflow
the tflow support for PKTDMA makes the tchan fix a bit problematic for
backporting, but it might worth a try to split to bcdma and
rchan/tchan/rflow patch.
--
Péter
next prev parent reply other threads:[~2021-02-10 7:51 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-09 9:00 [PATCH] dmaengine: ti: k3-udma: Fix NULL pointer dereference error Kishon Vijay Abraham I
2021-02-09 12:23 ` Péter Ujfalusi
2021-02-09 12:45 ` Kishon Vijay Abraham I
2021-02-10 7:50 ` Péter Ujfalusi [this message]
-- strict thread matches above, loose matches on Subject: below --
2021-02-09 12:02 Kishon Vijay Abraham I
2021-02-10 10:03 ` Péter Ujfalusi
2021-02-10 11:34 ` Kishon Vijay Abraham I
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=35a0a9a0-e938-da54-a500-624b2b6fcdeb@gmail.com \
--to=peter.ujfalusi@gmail.com \
--cc=dan.j.williams@intel.com \
--cc=dmaengine@vger.kernel.org \
--cc=grygorii.strashko@ti.com \
--cc=kishon@ti.com \
--cc=linux-kernel@vger.kernel.org \
--cc=vigneshr@ti.com \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox