Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     Kishon Vijay Abraham I <kishon@ti.com>,
        Dan Williams <dan.j.williams@intel.com>,
        Vinod Koul <vkoul@kernel.org>,
        Grygorii Strashko <grygorii.strashko@ti.com>,
        Vignesh Raghavendra <vigneshr@ti.com>
Cc:     dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20210209090036.30832-1-kishon@ti.com>
 <19488154-22d5-33b4-06a1-17e9a896ae04@gmail.com>
 <7e06c63d-606b-be78-84ff-d5a5c72f7ad7@ti.com>
From:   =?UTF-8?Q?P=c3=a9ter_Ujfalusi?= <peter.ujfalusi@gmail.com>
Subject: Re: [PATCH] dmaengine: ti: k3-udma: Fix NULL pointer dereference
 error
Message-ID: <35a0a9a0-e938-da54-a500-624b2b6fcdeb@gmail.com>
Date:   Wed, 10 Feb 2021 09:50:38 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.0
MIME-Version: 1.0
In-Reply-To: <7e06c63d-606b-be78-84ff-d5a5c72f7ad7@ti.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hi Kishon,

On 2/9/21 2:45 PM, Kishon Vijay Abraham I wrote:
> Hi Peter,
> 
> On 09/02/21 5:53 pm, Péter Ujfalusi wrote:
>> Hi Kishon,
>>
>> On 2/9/21 11:00 AM, Kishon Vijay Abraham I wrote:
>>> bcdma_get_*() and udma_get_*() checks if bchan/rchan/tchan/rflow is
>>> already allocated by checking if it has a NON NULL value. For the
>>> error cases, bchan/rchan/tchan/rflow will have error value
>>> and bcdma_get_*() and udma_get_*() considers this as already allocated
>>> (PASS) since the error values are NON NULL. This results in
>>> NULL pointer dereference error while de-referencing
>>> bchan/rchan/tchan/rflow.
>>
>> I think this can happen when a channel request fails and we get a second
>> request coming and faces with the not cleanup up tchan/rchan/bchan/rflow
>> from the previous failure.
>> Interesting that I have not faced with this, but it is a valid oversight
>> from me.
> 
> Thank you for reviewing.
> 
> Got into this issue when all the PCIe endpoint functions were requesting
> for a MEMCOPY channel (total 22 endpoint functions) specifically in
> bcdma_get_bchan() where the scenario you mentioned above happened.

I see, do we even have 22 bchan allocated for Linux out from the 40? ;)

> Vignesh asked me to fix it for all udma_get_*().

Yes, that is the right thing to do, thank you!

>>
>>> Reset the value of bchan/rchan/tchan/rflow to NULL if the allocation
>>> actually fails.
>>>
>>> Fixes: 017794739702 ("dmaengine: ti: k3-udma: Initial support for K3 BCDMA")
>>> Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA")
>>
>> Will this patch apply at any of these?
>> 25dcb5dd7b7c does not have BCDMA (bchan)
>> 017794739702 does not contain PKTDMA (tflow)
> 
> I can probably split this patch
> 017794739702 for bchan and 25dcb5dd7b7c for bchan/rchan/tchan/rflow

the tflow support for PKTDMA makes the tchan fix a bit problematic for
backporting, but it might worth a try to split to bcdma and
rchan/tchan/rflow patch.

-- 
Péter