Skip to contentSkip to conversation

rapidio: fix rio_dma_transfer error handling

PATCH New [email protected] 1 participant 1 message Apr 20, 2018

Subsystems (2)
Stable branch Rapidio
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 6/15 rapidio: fix rio_dma_transfer error handling

From: Ioan Nicu <[email protected]>
Subject: rapidio: fix rio_dma_transfer error handling

Some of the mport_dma_req structure members were initialized late inside the do_dma_request() function, just before submitting the request to the dma engine. But we have some error branches before that. In case of such an error, the code would return on the error path and trigger the calling of dma_req_free() with a req structure which is not completely initialized. This causes a NULL pointer dereference in dma_req_free().

This patch fixes these error branches by making sure that all necessary mport_dma_req structure members are initialized in rio_dma_transfer() immediately after the request structure gets allocated.

Link http://lkml.kernel.org/r/[email protected] open here
Fixes bbd876adb8c72 ("rapidio: use a reference count for struct mport_dma_req")
Signed-off-by Ioan Nicu <[email protected]>
Tested-by Alexander Sverdlin <[email protected]>
Acked-by Alexandre Bounine <[email protected]>
Cc Barry Wood <[email protected]>
Cc Matt Porter <[email protected]>
Cc Christophe JAILLET <[email protected]>
Cc Logan Gunthorpe <[email protected]>
Cc Chris Wilson <[email protected]>
Cc Tvrtko Ursulin <[email protected]>
Cc Frank Kunz <[email protected]>
Cc <[email protected]> [4.6+]
Signed-off-by Andrew Morton <[email protected]>

---

 drivers/rapidio/devices/rio_mport_cdev.c |   19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/rapidio/devices/rio_mport_cdev.c renamed from drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling +9 -10
diff -puN drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling drivers/rapidio/devices/rio_mport_cdev.c
@@ -740,10 +740,7 @@ static int do_dma_request(struct mport_d
 	tx->callback = dma_xfer_callback;
 	tx->callback_param = req;
 
-	req->dmach = chan;
-	req->sync = sync;
 	req->status = DMA_IN_PROGRESS;
-	init_completion(&req->req_comp);
 	kref_get(&req->refcount);
 
 	cookie = dmaengine_submit(tx);

@@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32
 	if (!req)
 		return -ENOMEM;
 
-	kref_init(&req->refcount);
-
 	ret = get_dma_channel(priv);
 	if (ret) {
 		kfree(req);
 		return ret;
 	}
+	chan = priv->dmach;
+
+	kref_init(&req->refcount);
+	init_completion(&req->req_comp);
+	req->dir = dir;
+	req->filp = filp;
+	req->priv = priv;
+	req->dmach = chan;
+	req->sync = sync;
 
 	/*
 	 * If parameter loc_addr != NULL, we are transferring data from/to

@@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32
 				xfer->offset, xfer->length);
 	}
 
-	req->dir = dir;
-	req->filp = filp;
-	req->priv = priv;
-	chan = priv->dmach;
-
 	nents = dma_map_sg(chan->device->dev,
 			   req->sgt.sgl, req->sgt.nents, dir);
 	if (nents == 0) {

_