[PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

[PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

[Christophe JAILLET]

If the 'queue_priority_mapping' is not provided, we need to allocate the
correct amount of memory. Each entry takes 2 s8, so actually less memory
than needed is allocated.

Update the size of each entry when the memory is devm_kcalloc'ed.

Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
However, this looks fine to me because of the 'nelm >>= 1;' before the
'for' loop.
---
 drivers/dma/ti/edma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
index 3ea8ef7f57df..f313e2cf542c 100644
--- a/drivers/dma/ti/edma.c
+++ b/drivers/dma/ti/edma.c
@@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
 	 * priority. So Q0 is the highest priority queue and the last queue has
 	 * the lowest priority.
 	 */
-	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
+	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
 					  GFP_KERNEL);
 	if (!queue_priority_map)
 		return -ENOMEM;
-- 
2.34.1

Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

[Péter Ujfalusi]

On 21/05/2022 20:26, Christophe JAILLET wrote:
> If the 'queue_priority_mapping' is not provided, we need to allocate the
> correct amount of memory. Each entry takes 2 s8, so actually less memory
> than needed is allocated.
> 
> Update the size of each entry when the memory is devm_kcalloc'ed.

Good catch, obviously this has not been hit for almost a decade :o

Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>

> 
> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
> However, this looks fine to me because of the 'nelm >>= 1;' before the
> 'for' loop.
> ---
>  drivers/dma/ti/edma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ea8ef7f57df..f313e2cf542c 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>  	 * priority. So Q0 is the highest priority queue and the last queue has
>  	 * the lowest priority.
>  	 */
> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
>  					  GFP_KERNEL);
>  	if (!queue_priority_map)
>  		return -ENOMEM;

-- 
Péter

Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

[Péter Ujfalusi]

On 21/05/2022 20:26, Christophe JAILLET wrote:
> If the 'queue_priority_mapping' is not provided, we need to allocate the
> correct amount of memory. Each entry takes 2 s8, so actually less memory
> than needed is allocated.
> 
> Update the size of each entry when the memory is devm_kcalloc'ed.
> 
> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
> However, this looks fine to me because of the 'nelm >>= 1;' before the
> 'for' loop.

This has been deprecated ever since we have moved to dma router to
handle the xbar for various TI platforms, but by the looks it kida looks
bogus in a same way.

> ---
>  drivers/dma/ti/edma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
> index 3ea8ef7f57df..f313e2cf542c 100644
> --- a/drivers/dma/ti/edma.c
> +++ b/drivers/dma/ti/edma.c
> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>  	 * priority. So Q0 is the highest priority queue and the last queue has
>  	 * the lowest priority.
>  	 */
> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
>  					  GFP_KERNEL);
>  	if (!queue_priority_map)
>  		return -ENOMEM;

-- 
Péter

Re: [PATCH] dmaengine: ti: Fix a potential under memory allocation issue in edma_setup_from_hw()

[Christophe JAILLET]

Le 28/05/2022 à 11:33, Péter Ujfalusi a écrit :
> 
> 
> On 21/05/2022 20:26, Christophe JAILLET wrote:
>> If the 'queue_priority_mapping' is not provided, we need to allocate the
>> correct amount of memory. Each entry takes 2 s8, so actually less memory
>> than needed is allocated.
>>
>> Update the size of each entry when the memory is devm_kcalloc'ed.
>>
>> Fixes: 6d10c3950bf4 ("ARM: edma: Get IP configuration from HW (number of channels, tc, etc)")
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>> ---
>> Note that the devm_kcalloc() in edma_xbar_event_map() looks also spurious.
>> However, this looks fine to me because of the 'nelm >>= 1;' before the
>> 'for' loop.
> 
> This has been deprecated ever since we have moved to dma router to
> handle the xbar for various TI platforms, but by the looks it kida looks
> bogus in a same way.

This one is correct, IIUC.

There is an extra ">> 1" before the loop. (see [1]).

CJ

[1]: 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/dma/ti/edma.c#n2173

> 
>> ---
>>   drivers/dma/ti/edma.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
>> index 3ea8ef7f57df..f313e2cf542c 100644
>> --- a/drivers/dma/ti/edma.c
>> +++ b/drivers/dma/ti/edma.c
>> @@ -2121,7 +2121,7 @@ static int edma_setup_from_hw(struct device *dev, struct edma_soc_info *pdata,
>>   	 * priority. So Q0 is the highest priority queue and the last queue has
>>   	 * the lowest priority.
>>   	 */
>> -	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
>> +	queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8) * 2,
>>   					  GFP_KERNEL);
>>   	if (!queue_priority_map)
>>   		return -ENOMEM;
>