Skip to contentSkip to conversation

spi: ep93xx: fix error pointer deref after DMA setup failure

PATCH In review Johan Hovold 3 participants 3 messages May 12 – May 13

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 spi: ep93xx: fix error pointer deref after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer on later probe errors or driver unbind.

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

Fixes e79e7c2df627 ("spi: ep93xx: add DT support for Cirrus EP93xx")
Cc Nikita Shubin <[email protected]>
---
 drivers/spi/spi-ep93xx.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/spi/spi-ep93xx.c +2 -0
index db50018050e5..f716c9607be4 100644
@@ -582,12 +582,14 @@ static int ep93xx_spi_setup_dma(struct device *dev, struct ep93xx_spi *espi)
 	espi->dma_rx = dma_request_chan(dev, "rx");
 	if (IS_ERR(espi->dma_rx)) {
 		ret = dev_err_probe(dev, PTR_ERR(espi->dma_rx), "rx DMA setup failed");
+		espi->dma_rx = NULL;
 		goto fail_free_page;
 	}
 
 	espi->dma_tx = dma_request_chan(dev, "tx");
 	if (IS_ERR(espi->dma_tx)) {
 		ret = dev_err_probe(dev, PTR_ERR(espi->dma_tx), "tx DMA setup failed");
+		espi->dma_tx = NULL;
 		goto fail_release_rx;
 	}
 
Signature · 1 line
2.53.0
Acked-by on v1 1/1
#1 lore raw
Quoted 9 lines · Johan Hovold

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer on later probe errors or driver unbind.

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

Quoted 6 lines
Fixes e79e7c2df627 ("spi: ep93xx: add DT support for Cirrus EP93xx")

Link:
https://sashiko.dev/#/patchset/20260429091333.165363-1-johan%40kernel.org?part=10

Quoted 26 lines

---
 drivers/spi/spi-ep93xx.c | 2 ++

 1 file changed, 2 insertions(+)
drivers/spi/spi-ep93xx.c +0 -0
index db50018050e5..f716c9607be4 100644
@@ -582,12 +582,14 @@ static int ep93xx_spi_setup_dma(struct device
 *dev, struct ep93xx_spi *espi)
  	espi->dma_rx = dma_request_chan(dev, "rx");
  	if (IS_ERR(espi->dma_rx)) {

  ret = dev_err_probe(dev, PTR_ERR(espi->dma_rx), "rx DMA setup failed");

drivers/spi/spi-ep93xx.c +1 -0
+		espi->dma_rx = NULL;

  goto fail_free_page;
  }

  espi->dma_tx = dma_request_chan(dev, "tx");
  if (IS_ERR(espi->dma_tx)) {
  ret = dev_err_probe(dev, PTR_ERR(espi->dma_tx), "tx DMA setup failed");

drivers/spi/spi-ep93xx.c +1 -0
+		espi->dma_tx = NULL;

  goto fail_release_rx;
  }

maintainer
#2 lore raw
In reply to Johan Hovold
Quoted 1 line · Johan Hovold

spi: ep93xx: fix error pointer deref after DMA setup failure

Applied to

https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-7.1

Thanks!

[1/1] spi: ep93xx: fix error pointer deref after DMA setup failure

      https://git.kernel.org/broonie/spi/c/5e121a81667a

All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying to this mail.

Thanks,
Mark