Unverified Commit ff4542b0 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5875 v3 CVE-2024-26771 

Merge Pull Request from: @ci-robot 
 
PR sync from: GUO Zihua <guozihua@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GZMHLPNWNJOCC2225CS6RJPQWL6JG7FR/ 
This patchset fixes CVE-2024-26771.

Conflicts of patch 2 and 3 is cause by commit 31f4b28f ("dmaengine:
ti: edma: Add support for handling reserved channels") not being merged,
which has been adapted.

Conflicts of patch 4 is a context conflict which does not effect the
effectiveness of this patch.

v3:
  Added CVE tags for all patches as per request.
v2:
  Removed CVE dedication for the first 3 patches.

Chuhong Yuan (2):
  dmaengine: ti: edma: fix missed failure handling
  dmaengine: ti: edma: add missed operations

Kunwu Chan (1):
  dmaengine: ti: edma: Add some null pointer checks to the edma_probe

Wei Yongjun (1):
  dmaengine: ti: edma: Fix error return code in edma_probe()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9E2MP 
 
Link:https://gitee.com/openeuler/kernel/pulls/5875

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 9b7534a0 a654421e

drivers/dma/ti/edma.c

+36 −17
Original line number Diff line number Diff line
@@ -2218,13 +2218,6 @@ static int edma_probe(struct platform_device *pdev) 
	if (!info)

		return -ENODEV;



	pm_runtime_enable(dev);

	ret = pm_runtime_get_sync(dev);

	if (ret < 0) {

		dev_err(dev, "pm_runtime_get_sync() failed\n");

		return ret;

	}



	ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));

	if (ret)

		return ret;
@@ -2255,21 +2248,29 @@ static int edma_probe(struct platform_device *pdev) 


	platform_set_drvdata(pdev, ecc);



	pm_runtime_enable(dev);

	ret = pm_runtime_get_sync(dev);

	if (ret < 0) {

		dev_err(dev, "pm_runtime_get_sync() failed\n");

		pm_runtime_disable(dev);

		return ret;

	}



	/* Get eDMA3 configuration from IP */

	ret = edma_setup_from_hw(dev, info, ecc);

	if (ret)

		return ret;

		goto err_disable_pm;



	/* Allocate memory based on the information we got from the IP */

	ecc->slave_chans = devm_kcalloc(dev, ecc->num_channels,

					sizeof(*ecc->slave_chans), GFP_KERNEL);

	if (!ecc->slave_chans)

		return -ENOMEM;



	ecc->slot_inuse = devm_kcalloc(dev, BITS_TO_LONGS(ecc->num_slots),

				       sizeof(unsigned long), GFP_KERNEL);

	if (!ecc->slot_inuse)

		return -ENOMEM;

	if (!ecc->slave_chans || !ecc->slot_inuse) {

		ret = -ENOMEM;

		goto err_disable_pm;

	}



	ecc->default_queue = info->default_queue;
@@ -2306,11 +2307,16 @@ static int edma_probe(struct platform_device *pdev) 
	if (irq >= 0) {

		irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint",

					  dev_name(dev));

		if (!irq_name) {

			ret = -ENOMEM;

			goto err_disable_pm;

		}



		ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name,

				       ecc);

		if (ret) {

			dev_err(dev, "CCINT (%d) failed --> %d\n", irq, ret);

			return ret;

			goto err_disable_pm;

		}

		ecc->ccint = irq;

	}
@@ -2322,11 +2328,16 @@ static int edma_probe(struct platform_device *pdev) 
	if (irq >= 0) {

		irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint",

					  dev_name(dev));

		if (!irq_name) {

			ret = -ENOMEM;

			goto err_disable_pm;

		}



		ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name,

				       ecc);

		if (ret) {

			dev_err(dev, "CCERRINT (%d) failed --> %d\n", irq, ret);

			return ret;

			goto err_disable_pm;

		}

		ecc->ccerrint = irq;

	}
@@ -2334,7 +2345,8 @@ static int edma_probe(struct platform_device *pdev) 
	ecc->dummy_slot = edma_alloc_slot(ecc, EDMA_SLOT_ANY);

	if (ecc->dummy_slot < 0) {

		dev_err(dev, "Can't allocate PaRAM dummy slot\n");

		return ecc->dummy_slot;

		ret = ecc->dummy_slot;

		goto err_disable_pm;

	}



	queue_priority_mapping = info->queue_priority_mapping;
@@ -2345,8 +2357,10 @@ static int edma_probe(struct platform_device *pdev) 


		ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,

					    sizeof(*ecc->tc_list), GFP_KERNEL);

		if (!ecc->tc_list)

			return -ENOMEM;

		if (!ecc->tc_list) {

			ret = -ENOMEM;

			goto err_reg1;

		}



		for (i = 0;; i++) {

			ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
@@ -2416,6 +2430,9 @@ static int edma_probe(struct platform_device *pdev) 


err_reg1:

	edma_free_slot(ecc, ecc->dummy_slot);

err_disable_pm:

	pm_runtime_put_sync(dev);

	pm_runtime_disable(dev);

	return ret;

}
@@ -2446,6 +2463,8 @@ static int edma_remove(struct platform_device *pdev) 
	if (ecc->dma_memcpy)

		dma_async_device_unregister(ecc->dma_memcpy);

	edma_free_slot(ecc, ecc->dummy_slot);

	pm_runtime_put_sync(dev);

	pm_runtime_disable(dev);



	return 0;

}