dmaengine: ti: Add NULL check in udma_probe()

[PATCH v1] dmaengine: ti: Add NULL check in udma_probe()

Posted by Henry Martin 10 months, 1 week ago

devm_kasprintf() returns NULL when memory allocation fails. Currently,
udma_probe() does not check for this case, which results in a NULL
pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/dma/ti/k3-udma.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index 7ed1956b4642..f1c2f8170730 100644
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -5582,7 +5582,8 @@ static int udma_probe(struct platform_device *pdev)
 		uc->config.dir = DMA_MEM_TO_MEM;
 		uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d",
 					  dev_name(dev), i);
-
+		if (!uc->name)
+			return -ENOMEM;
 		vchan_init(&uc->vc, &ud->ddev);
 		/* Use custom vchan completion handling */
 		tasklet_setup(&uc->vc.task, udma_vchan_complete);
-- 
2.34.1

Re: [PATCH v1] dmaengine: ti: Add NULL check in udma_probe()

Posted by Vinod Koul 8 months, 4 weeks ago

On Wed, 02 Apr 2025 10:39:00 +0800, Henry Martin wrote:
> devm_kasprintf() returns NULL when memory allocation fails. Currently,
> udma_probe() does not check for this case, which results in a NULL
> pointer dereference.
> 
> Add NULL check after devm_kasprintf() to prevent this issue.
> 
> 
> [...]

Applied, thanks!

[1/1] dmaengine: ti: Add NULL check in udma_probe()
      commit: fd447415e74bccd7362f760d4ea727f8e1ebfe91

Best regards,
-- 
~Vinod

Re: [PATCH v1] dmaengine: ti: Add NULL check in udma_probe()

Posted by henry martin 9 months, 2 weeks ago

Hi Peter, Vinod,

I hope this email finds you well. I wanted to follow up on my previous patch
submission to check if there are any additional feedback or changes you'd like
me to address. If so, I’d be happy to incorporate them and send a v2.

Please let me know your thoughts. Thanks for your time and review!

Best regards,
Henry

Henry Martin <bsdhenrymartin@gmail.com> 于2025年4月2日周三 10:39写道：
>
> devm_kasprintf() returns NULL when memory allocation fails. Currently,
> udma_probe() does not check for this case, which results in a NULL
> pointer dereference.
>
> Add NULL check after devm_kasprintf() to prevent this issue.
>
> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  drivers/dma/ti/k3-udma.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 7ed1956b4642..f1c2f8170730 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
> @@ -5582,7 +5582,8 @@ static int udma_probe(struct platform_device *pdev)
>                 uc->config.dir = DMA_MEM_TO_MEM;
>                 uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d",
>                                           dev_name(dev), i);
> -
> +               if (!uc->name)
> +                       return -ENOMEM;
>                 vchan_init(&uc->vc, &ud->ddev);
>                 /* Use custom vchan completion handling */
>                 tasklet_setup(&uc->vc.task, udma_vchan_complete);
> --
> 2.34.1
>

Re: [PATCH v1] dmaengine: ti: Add NULL check in udma_probe()

Posted by Péter Ujfalusi 9 months, 1 week ago

Hi,

On 4/24/25 6:10 AM, henry martin wrote:
> Hi Peter, Vinod,
> 
> I hope this email finds you well. I wanted to follow up on my previous patch
> submission to check if there are any additional feedback or changes you'd like
> me to address. If so, I’d be happy to incorporate them and send a v2.

For some reason I don't have the original patch in my mailbox, but looks
good, thank you.

> Please let me know your thoughts. Thanks for your time and review!

Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
> Best regards,
> Henry
> 
> Henry Martin <bsdhenrymartin@gmail.com> 于2025年4月2日周三 10:39写道：
>>
>> devm_kasprintf() returns NULL when memory allocation fails. Currently,
>> udma_probe() does not check for this case, which results in a NULL
>> pointer dereference.
>>
>> Add NULL check after devm_kasprintf() to prevent this issue.
>>
>> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
>> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
>> ---
>>  drivers/dma/ti/k3-udma.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
>> index 7ed1956b4642..f1c2f8170730 100644
>> --- a/drivers/dma/ti/k3-udma.c
>> +++ b/drivers/dma/ti/k3-udma.c
>> @@ -5582,7 +5582,8 @@ static int udma_probe(struct platform_device *pdev)
>>                 uc->config.dir = DMA_MEM_TO_MEM;
>>                 uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d",
>>                                           dev_name(dev), i);
>> -
>> +               if (!uc->name)
>> +                       return -ENOMEM;
>>                 vchan_init(&uc->vc, &ud->ddev);
>>                 /* Use custom vchan completion handling */
>>                 tasklet_setup(&uc->vc.task, udma_vchan_complete);
>> --
>> 2.34.1
>>

-- 
Péter

Re: [PATCH v1] dmaengine: ti: Add NULL check in udma_probe()

Posted by Nathan Lynch 9 months, 3 weeks ago

Henry Martin <bsdhenrymartin@gmail.com> writes:
> devm_kasprintf() returns NULL when memory allocation fails. Currently,
> udma_probe() does not check for this case, which results in a NULL
> pointer dereference.

Yes, it does look like this would happen when uc->name is eventually
passed to dma_pool_create(), at least.

>
> Add NULL check after devm_kasprintf() to prevent this issue.
>
> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  drivers/dma/ti/k3-udma.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
> index 7ed1956b4642..f1c2f8170730 100644
> --- a/drivers/dma/ti/k3-udma.c
> +++ b/drivers/dma/ti/k3-udma.c
> @@ -5582,7 +5582,8 @@ static int udma_probe(struct platform_device *pdev)
>  		uc->config.dir = DMA_MEM_TO_MEM;
>  		uc->name = devm_kasprintf(dev, GFP_KERNEL, "%s chan%d",
>  					  dev_name(dev), i);
> -
> +		if (!uc->name)
> +			return -ENOMEM;
>  		vchan_init(&uc->vc, &ud->ddev);
>  		/* Use custom vchan completion handling */
>  		tasklet_setup(&uc->vc.task, udma_vchan_complete);

Returning -ENOMEM directly seems fine, even though this is in a loop
200+ lines into udma_probe(). I don't see any unmanaged device resources
that need to be released before returning, and if I missed one, all the
error paths this code precedes would have the same problem.

Reviewed-by: Nathan Lynch <nathan.lynch@amd.com>