Commit 5e857047 authored by Kuninori Morimoto's avatar Kuninori Morimoto Committed by Vinod Koul
Browse files

dmaengine: rcar-dmac: initialize all data before registering IRQ handler 



Anton Volkov noticed that engine->dev is NULL before
of_dma_controller_register() in probe.
Thus there might be a NULL pointer dereference in
rcar_dmac_chan_start_xfer while accessing chan->chan.device->dev which
is equal to (&dmac->engine)->dev.
On same reason, same and similar things will happen if we didn't
initialize all necessary data before calling register irq function.
To be more safety code, this patch initialize all necessary data
before calling register irq function.

Reported-by: default avatarAnton Volkov <avolkov@ispras.ru>
Signed-off-by: default avatarKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: default avatarVinod Koul <vinod.koul@intel.com>
parent 87c56dcb

drivers/dma/sh/rcar-dmac.c

+43 −42
Original line number Diff line number Diff line
@@ -1690,6 +1690,15 @@ static int rcar_dmac_chan_probe(struct rcar_dmac *dmac, 
	if (!irqname)

		return -ENOMEM;



	/*

	 * Initialize the DMA engine channel and add it to the DMA engine

	 * channels list.

	 */

	chan->device = &dmac->engine;

	dma_cookie_init(chan);



	list_add_tail(&chan->device_node, &dmac->engine.channels);



	ret = devm_request_threaded_irq(dmac->dev, rchan->irq,

					rcar_dmac_isr_channel,

					rcar_dmac_isr_channel_thread, 0,
@@ -1700,15 +1709,6 @@ static int rcar_dmac_chan_probe(struct rcar_dmac *dmac, 
		return ret;

	}



	/*

	 * Initialize the DMA engine channel and add it to the DMA engine

	 * channels list.

	 */

	chan->device = &dmac->engine;

	dma_cookie_init(chan);



	list_add_tail(&chan->device_node, &dmac->engine.channels);



	return 0;

}
@@ -1794,14 +1794,6 @@ static int rcar_dmac_probe(struct platform_device *pdev) 
	if (!irqname)

		return -ENOMEM;



	ret = devm_request_irq(&pdev->dev, irq, rcar_dmac_isr_error, 0,

			       irqname, dmac);

	if (ret) {

		dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",

			irq, ret);

		return ret;

	}



	/* Enable runtime PM and initialize the device. */

	pm_runtime_enable(&pdev->dev);

	ret = pm_runtime_get_sync(&pdev->dev);
@@ -1818,28 +1810,9 @@ static int rcar_dmac_probe(struct platform_device *pdev) 
		goto error;

	}



	/* Initialize the channels. */

	INIT_LIST_HEAD(&dmac->engine.channels);



	for (i = 0; i < dmac->n_channels; ++i) {

		ret = rcar_dmac_chan_probe(dmac, &dmac->channels[i],

					   i + channels_offset);

		if (ret < 0)

			goto error;

	}



	/* Register the DMAC as a DMA provider for DT. */

	ret = of_dma_controller_register(pdev->dev.of_node, rcar_dmac_of_xlate,

					 NULL);

	if (ret < 0)

		goto error;



	/*

	 * Register the DMA engine device.

	 *

	 * Default transfer size of 32 bytes requires 32-byte alignment.

	 */

	/* Initialize engine */

	engine = &dmac->engine;



	dma_cap_set(DMA_MEMCPY, engine->cap_mask);

	dma_cap_set(DMA_SLAVE, engine->cap_mask);
@@ -1862,6 +1835,34 @@ static int rcar_dmac_probe(struct platform_device *pdev) 
	engine->device_issue_pending		= rcar_dmac_issue_pending;

	engine->device_synchronize		= rcar_dmac_device_synchronize;



	INIT_LIST_HEAD(&engine->channels);



	for (i = 0; i < dmac->n_channels; ++i) {

		ret = rcar_dmac_chan_probe(dmac, &dmac->channels[i],

					   i + channels_offset);

		if (ret < 0)

			goto error;

	}



	ret = devm_request_irq(&pdev->dev, irq, rcar_dmac_isr_error, 0,

			       irqname, dmac);

	if (ret) {

		dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",

			irq, ret);

		return ret;

	}



	/* Register the DMAC as a DMA provider for DT. */

	ret = of_dma_controller_register(pdev->dev.of_node, rcar_dmac_of_xlate,

					 NULL);

	if (ret < 0)

		goto error;



	/*

	 * Register the DMA engine device.

	 *

	 * Default transfer size of 32 bytes requires 32-byte alignment.

	 */

	ret = dma_async_device_register(engine);

	if (ret < 0)

		goto error;

CRA Git | Maintained and supported by SUSTech CRA and CCSE