kernel/linux.git/drivers/dma/dmaengine.c, branch v6.6.132

dmaengine: fix NULL pointer in channel unregistration function

2024-02-01T00:18:47+00:00

[ Upstream commit f5c24d94512f1b288262beda4d3dcb9629222fc7 ] __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local is nullified. When dma_async_device_unregister() is called (because of managed API or intentionally by DMA controller driver), channels are unconditionally unregistered, leading to this NULL pointer: [ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [...] [ 1.484499] Call trace: [ 1.486930] device_del+0x40/0x394 [ 1.490314] device_unregister+0x20/0x7c [ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0 Look at dma_async_device_register() function error path, channel device unregistration is done only if chan->local is not NULL. Then add the same condition at the beginning of __dma_async_device_channel_unregister() function, to avoid NULL pointer issue whatever the API used to reach this function. Fixes: d2fb0a043838 ("dmaengine: break out channel registration") Signed-off-by: Amelie Delaunay Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.com Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin

dmaengine: Simplify dma_async_device_register()

2023-08-21T13:06:46+00:00

There are a lot of duplicate codes for checking if the dma has some capability. Define a temporary macro that is used to check if the dma claims some capability and if the corresponding function is implemented. Signed-off-by: Yajun Deng Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230815072346.2798927-1-yajun.deng@linux.dev Signed-off-by: Vinod Koul

dmaengine: Actually use devm_add_action_or_reset()

2023-03-17T17:43:42+00:00

It appears that the commit a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function") mentions devm_add_action_or_reset() the actual change utilised devm_add_action() call by mistake. Fix the issue by switching to devm_add_action_or_reset(). Fixes: a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230213112138.32118-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul

Merge tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

2023-02-25T01:18:54+00:00

Pull dmaengine updates from Vinod Koul: "A new driver, couple of device support and binding conversion along with bunch of driver updates are the main features of this. New hardware support: - TI AM62Ax controller support - Xilinx xdma driver - Qualcomm SM6125, SM8550, QDU1000/QRU1000 GPI controller Updates: - Runtime pm support for at_xdmac driver - IMX sdma binding conversion to yaml and HDMI audio support - IMX mxs binding conversion to yaml" * tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (35 commits) dmaengine: idma64: Update bytes_transferred field dmaengine: imx-sdma: Set DMA channel to be private dmaengine: dw: Move check for paused channel to dwc_get_residue() dmaengine: ptdma: check for null desc before calling pt_cmd_callback dmaengine: dw-axi-dmac: Do not dereference NULL structure dmaengine: idxd: Fix default allowed read buffers value in group dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: Simplify dmaenginem_async_device_register() function dmaengine: use sysfs_emit() to instead of scnprintf() dmaengine: Make an order in struct dma_device definition dt-bindings: dma: cleanup examples - indentation, lowercase hex dt-bindings: dma: drop unneeded quotes dmaengine: xilinx: xdma: Add user logic interrupt support dmaengine: xilinx: xdma: Add xilinx xdma driver dmaengine: drivers: Use devm_platform_ioremap_resource() dmaengine: at_xdmac: remove empty line dmaengine: at_xdmac: add runtime pm support dmaengine: at_xdmac: align properly function members dmaengine: ppc4xx: Convert to use sysfs_emit()/sysfs_emit_at() APIs dmaengine: sun6i: Set the maximum segment size ...

dmaengine: Simplify dmaenginem_async_device_register() function

2023-02-10T06:07:45+00:00

Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230130112830.52353-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul

dmaengine: use sysfs_emit() to instead of scnprintf()

2023-02-10T06:07:45+00:00

Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230130111141.59627-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul

dmaengine: Fix double increment of client_count in dma_chan_get()

2023-01-18T12:06:49+00:00

The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko Reviewed-by: Jie Hai Test-by: Jie Hai Reviewed-by: Jerry Snitselaar Reviewed-by: Dave Jiang Tested-by: Joel Savitz Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul

dmaengine: remove DMA_MEMCPY_SG once again

2022-06-27T06:31:40+00:00

This was removed before due to the complete lack of users, but 3218910fd585 ("dmaengine: Add core function and capability check for DMA_MEMCPY_SG") and 29cf37fa6dd9 ("dmaengine: Add consumer for the new DMA_MEMCPY_SG API function.") added it back despite still not having any users whatsoever. Fixes: 3218910fd585 ("dmaengine: Add core function and capability check for DMA_MEMCPY_SG") Fixes: 29cf37fa6dd9 ("dmaengine: Add consumer for the new DMA_MEMCPY_SG API function.") Signed-off-by: Christoph Hellwig Acked-by: Michal Simek Link: https://lore.kernel.org/r/20220606074733.622616-1-hch@lst.de Signed-off-by: Vinod Koul

dmaengine: Remove a useless mutex

2022-04-11T14:22:40+00:00

According to lib/idr.c, The IDA handles its own locking. It is safe to call any of the IDA functions without synchronisation in your code. so the 'chan_mutex' mutex can just be removed. It is here only to protect some ida_alloc()/ida_free() calls. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/7180452c1d77b039e27b6f9418e0e7d9dd33c431.1644140845.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul

dmaengine: Add core function and capability check for DMA_MEMCPY_SG

2021-11-22T06:08:05+00:00

This is the old DMA_SG interface that was removed in commit c678fa66341c ("dmaengine: remove DMA_SG as it is dead code in kernel"). It has been renamed to DMA_MEMCPY_SG to better match the MEMSET and MEMSET_SG naming convention. It should only be used for mem2mem copies, either main system memory or CPU-addressable device memory (like video memory on a PCI graphics card). Bringing back this interface was prompted by the need to use the Xilinx CDMA device for mem2mem SG transfers. Signed-off-by: Adrian Larumbe Link: https://lore.kernel.org/r/20211101180825.241048-3-adrianml@alumnos.upm.es Signed-off-by: Vinod Koul