Received-SPF: pass (google.com: domain of linux-kernel+bounces-34862-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <ea1a51bb-4e82-4df6-88b3-e080448eb4ab@kylinos.cn>
Date: Tue, 23 Jan 2024 16:00:38 +0800
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] dmaengine: Add a null pointer check to the
 dma_request_chan
To: Vinod Koul <vkoul@kernel.org>
Cc: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20240118033052.193282-1-chentao@kylinos.cn>
 <Za5QoCO_o0duPJ4J@matsya>
Content-Language: en-US
From: Kunwu Chan <chentao@kylinos.cn>
In-Reply-To: <Za5QoCO_o0duPJ4J@matsya>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable

Thanks for your reply.

On 2024/1/22 19:25, Vinod Koul wrote:
> On 18-01-24, 11:30, Kunwu Chan wrote:
>> kasprintf() returns a pointer to dynamically allocated memory
>> which can be NULL upon failure. Ensure the allocation was successful
>> by checking the pointer validity.
>>
>> Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
>> ---
>>   drivers/dma/dmaengine.c | 2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
>> index 491b22240221..a6f808d13aa4 100644
>> --- a/drivers/dma/dmaengine.c
>> +++ b/drivers/dma/dmaengine.c
>> @@ -856,6 +856,8 @@ struct dma_chan *dma_request_chan(struct device *d=
ev, const char *name)
>>   #ifdef CONFIG_DEBUG_FS
>>   	chan->dbg_client_name =3D kasprintf(GFP_KERNEL, "%s:%s", dev_name(d=
ev),
>>   					  name);
>> +	if (!chan->dbg_client_name)
>> +		return chan;
>=20
> That is wrong, you cant return a half done channel here
> Pls see rest of the code for reference
I handle the error path like line 862 in 'dma_request_chan', though i=20
think it's not so perfect. Why it just return chan in line 862 when in=20
error? I would be very grateful if it could help me solve this puzzle

dma_request_chan find and return the ``name`` DMA channel associated=20
with the 'dev' device. The association is done via DT, ACPI or board=20
file based dma_slave_map matching table.

So when error occurs, just do the opposite, like in 'dma_release_channel'=
.

look likes:
---

         chan->dbg_client_name =3D kasprintf(GFP_KERNEL, "%s:%s",=20
dev_name(dev),
                                           name);
+       if (!chan->dbg_client_name) {
+               dma_cap_clear(DMA_SLAVE, chan->device->cap_mask);
+               dma_cap_zero(chan->device->cap_mask);
+               dma_chan_put(chan);
+               chan->slave =3D NULL;
+               chan =3D NULL;
+               return chan;
+       }

---
It's that right by clear the cap and set chan to NULL=EF=BC=9F


>=20
>>   #endif
>>  =20
>>   	chan->name =3D kasprintf(GFP_KERNEL, "dma:%s", name);
>> --=20
>> 2.39.2
>=20
--=20
Thanks,
   Kunwu