2022-05-22 12:09:02

by Christophe JAILLET

[permalink] [raw]
Subject: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

If the 'queue_priority_mapping' is not provided, we need to allocate the
correct amount of memory. Each entry takes 2 s8, so actually less memory
than needed is allocated.

Update the size of each entry when the memory is devm_kcalloc'ed.

Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
Signed-off-by: Christophe JAILLET <[email protected]>
---
Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
However, this looks fine to me because of the 'nelm >>= 1;' before the
'for' loop.
---
drivers/dma/ti/edma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index 3ea8ef7f57df..f313e2cf542c 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
* priority. So Q0 is the highest priority queue and the last queue has
* the lowest priority.
*/
- queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
+ queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
GFP_KERNEL);
if (!queue_priority_map)
return -ENOMEM;
--
2.34.1



2022-05-28 18:23:14

by Christophe JAILLET

[permalink] [raw]
Subject: Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

Le 28/05/2022 à 11:33, Péter Ujfalusi a écrit :
>
>
> On 21/05/2022 20:26, Christophe JAILLET wrote:
>> If the 'queue_priority_mapping' is not provided, we need to allocate the
>> correct amount of memory. Each entry takes 2 s8, so actually less memory
>> than needed is allocated.
>>
>> Update the size of each entry when the memory is devm_kcalloc'ed.
>>
>> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
>> Signed-off-by: Christophe JAILLET <[email protected]>
>> ---
>> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
>> However, this looks fine to me because of the 'nelm >>= 1;' before the
>> 'for' loop.
>
> This has been deprecated ever since we have moved to dma router to
> handle the xbar for various TI platforms, but by the looks it kida looks
> bogus in a same way.

This one is correct, IIUC.

There is an extra ">> 1" before the loop. (see [1]).

CJ

[1]:
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/dma/ti/edma.c#n2173

>
>> ---
>> drivers/dma/ti/edma.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
>> index 3ea8ef7f57df..f313e2cf542c 100644
>> --- a/drivers/dma/ti/edma.c
>> +++ b/drivers/dma/ti/edma.c
>> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>> * priority. So Q0 is the highest priority queue and the last queue has
>> * the lowest priority.
>> */
>> - queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
>> + queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
>> GFP_KERNEL);
>> if (!queue_priority_map)
>> return -ENOMEM;
>


2022-05-28 19:51:06

by Péter Ujfalusi

[permalink] [raw]
Subject: Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()



On 21/05/2022 20:26, Christophe JAILLET wrote:
> If the 'queue_priority_mapping' is not provided, we need to allocate the
> correct amount of memory. Each entry takes 2 s8, so actually less memory
> than needed is allocated.
>
> Update the size of each entry when the memory is devm_kcalloc'ed.

Good catch, obviously this has not been hit for almost a decade :o

Acked-by: Peter Ujfalusi <[email protected]>

>
> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
> Signed-off-by: Christophe JAILLET <[email protected]>
> ---
> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
> However, this looks fine to me because of the 'nelm >>= 1;' before the
> 'for' loop.
> ---
> drivers/dma/ti/edma.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ea8ef7f57df..f313e2cf542c 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
> * priority. So Q0 is the highest priority queue and the last queue has
> * the lowest priority.
> */
> - queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> + queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
> GFP_KERNEL);
> if (!queue_priority_map)
> return -ENOMEM;

--
Péter

2022-05-28 20:27:55

by Péter Ujfalusi

[permalink] [raw]
Subject: Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()



On 21/05/2022 20:26, Christophe JAILLET wrote:
> If the 'queue_priority_mapping' is not provided, we need to allocate the
> correct amount of memory. Each entry takes 2 s8, so actually less memory
> than needed is allocated.
>
> Update the size of each entry when the memory is devm_kcalloc'ed.
>
> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
> Signed-off-by: Christophe JAILLET <[email protected]>
> ---
> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
> However, this looks fine to me because of the 'nelm >>= 1;' before the
> 'for' loop.

This has been deprecated ever since we have moved to dma router to
handle the xbar for various TI platforms, but by the looks it kida looks
bogus in a same way.

> ---
> drivers/dma/ti/edma.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ea8ef7f57df..f313e2cf542c 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
> * priority. So Q0 is the highest priority queue and the last queue has
> * the lowest priority.
> */
> - queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> + queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
> GFP_KERNEL);
> if (!queue_priority_map)
> return -ENOMEM;

--
Péter