[PATCH 0/4] ZynqMP DMA fixes

[PATCH 0/4] ZynqMP DMA fixes

[Harini Katakam]

Address coverage related issues in ZynqMP DMA driver.

Shravya Kumbham (4):
  dmaengine: zynqmp_dma: Typecast the variable to handle overflow
  dmaengine: zynqmp_dma: Typecast the variable with dma_addr_t to handle
    overflow
  dmaengine: zynqmp_dma: Add conditions for return value check
  dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning

 drivers/dma/xilinx/zynqmp_dma.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

-- 
2.17.1

[PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow

[Harini Katakam]

From: Shravya Kumbham <shravya.kumbham@xilinx.com>

In zynqmp_dma_alloc/free_chan_resources functions there is a
potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
		   ZYNQMP_DMA_NUM_DESCS),
		   &chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
                 ZYNQMP_DMA_NUM_DESCS),
                chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS are 32 bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by using typecast.

Addresses-Coverity: Event overflow_before_widen.
Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
 drivers/dma/xilinx/zynqmp_dma.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 5fecf5aa6e85..2d0eba25739d 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
 	}
 
 	chan->desc_pool_v = dma_alloc_coherent(chan->dev,
-					       (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS),
+					       ((size_t)(2 * chan->desc_size) *
+						ZYNQMP_DMA_NUM_DESCS),
 					       &chan->desc_pool_p, GFP_KERNEL);
 	if (!chan->desc_pool_v)
 		return -ENOMEM;
@@ -677,7 +678,8 @@ static void zynqmp_dma_free_chan_resources(struct dma_chan *dchan)
 	zynqmp_dma_free_descriptors(chan);
 	spin_unlock_irqrestore(&chan->lock, irqflags);
 	dma_free_coherent(chan->dev,
-		(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS),
+		((size_t)(2 * ZYNQMP_DMA_DESC_SIZE(chan)) *
+		 ZYNQMP_DMA_NUM_DESCS),
 		chan->desc_pool_v, chan->desc_pool_p);
 	kfree(chan->sw_desc_pool);
 	pm_runtime_mark_last_busy(chan->dev);
-- 
2.17.1

Re: [PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow

[Michael Tretter]

Hi Harini,

On Tue, 14 Sep 2021 13:58:14 +0530, Harini Katakam wrote:
> From: Shravya Kumbham <shravya.kumbham@xilinx.com>
> 
> In zynqmp_dma_alloc/free_chan_resources functions there is a
> potential overflow in the below expressions.
> 
> dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
> 		   ZYNQMP_DMA_NUM_DESCS),
> 		   &chan->desc_pool_p, GFP_KERNEL);
> 
> dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
>                  ZYNQMP_DMA_NUM_DESCS),
>                 chan->desc_pool_v, chan->desc_pool_p);
> 
> The arguments desc_size and ZYNQMP_DMA_NUM_DESCS are 32 bit. Though
> this overflow condition is not observed but it is a potential problem
> in the case of 32-bit multiplication. Hence fix it by using typecast.
> 
> Addresses-Coverity: Event overflow_before_widen.
> Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>

Thanks for the patch.

Your SoB is missing in this and the other patches of this series.

> ---
>  drivers/dma/xilinx/zynqmp_dma.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
> index 5fecf5aa6e85..2d0eba25739d 100644
> --- a/drivers/dma/xilinx/zynqmp_dma.c
> +++ b/drivers/dma/xilinx/zynqmp_dma.c
> @@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
>  	}
>  
>  	chan->desc_pool_v = dma_alloc_coherent(chan->dev,
> -					       (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS),
> +					       ((size_t)(2 * chan->desc_size) *
> +						ZYNQMP_DMA_NUM_DESCS),

Wouldn't it be easier to change the type of chan->desc_size to size_t? Maybe
we could also just calculate the size of the descriptor pool during probe() to
make the code more readable?

I also noticed that there is the ZYNQMP_DMA_DESC_SIZE() macro, which is
inconsistently used in the driver. Maybe you could cleanup this as well as you
are at it?

>  					       &chan->desc_pool_p, GFP_KERNEL);
>  	if (!chan->desc_pool_v)
>  		return -ENOMEM;
> @@ -677,7 +678,8 @@ static void zynqmp_dma_free_chan_resources(struct dma_chan *dchan)
>  	zynqmp_dma_free_descriptors(chan);
>  	spin_unlock_irqrestore(&chan->lock, irqflags);
>  	dma_free_coherent(chan->dev,
> -		(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS),
> +		((size_t)(2 * ZYNQMP_DMA_DESC_SIZE(chan)) *
> +		 ZYNQMP_DMA_NUM_DESCS),

With a pre-calculated descriptor pool size, recalculating the size here
wouldn't be necessary anymore.

Michael

>  		chan->desc_pool_v, chan->desc_pool_p);
>  	kfree(chan->sw_desc_pool);
>  	pm_runtime_mark_last_busy(chan->dev);
> -- 
> 2.17.1
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
> 

Re: [PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow

[Vinod Koul]

On 14-09-21, 13:58, Harini Katakam wrote:
> From: Shravya Kumbham <shravya.kumbham@xilinx.com>
> 
> In zynqmp_dma_alloc/free_chan_resources functions there is a
> potential overflow in the below expressions.
> 
> dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
> 		   ZYNQMP_DMA_NUM_DESCS),
> 		   &chan->desc_pool_p, GFP_KERNEL);
> 
> dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
>                  ZYNQMP_DMA_NUM_DESCS),
>                 chan->desc_pool_v, chan->desc_pool_p);
> 
> The arguments desc_size and ZYNQMP_DMA_NUM_DESCS are 32 bit. Though
> this overflow condition is not observed but it is a potential problem
> in the case of 32-bit multiplication. Hence fix it by using typecast.
> 
> Addresses-Coverity: Event overflow_before_widen.
> Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>

Patch was sent by Harini Katakam <harini.katakam@xilinx.com> and SOB not
available for person sending this patch, sorry cant accept it with
s-o-b...

> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
> ---
>  drivers/dma/xilinx/zynqmp_dma.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
> index 5fecf5aa6e85..2d0eba25739d 100644
> --- a/drivers/dma/xilinx/zynqmp_dma.c
> +++ b/drivers/dma/xilinx/zynqmp_dma.c
> @@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
>  	}
>  
>  	chan->desc_pool_v = dma_alloc_coherent(chan->dev,
> -					       (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS),
> +					       ((size_t)(2 * chan->desc_size) *
> +						ZYNQMP_DMA_NUM_DESCS),
>  					       &chan->desc_pool_p, GFP_KERNEL);
>  	if (!chan->desc_pool_v)
>  		return -ENOMEM;
> @@ -677,7 +678,8 @@ static void zynqmp_dma_free_chan_resources(struct dma_chan *dchan)
>  	zynqmp_dma_free_descriptors(chan);
>  	spin_unlock_irqrestore(&chan->lock, irqflags);
>  	dma_free_coherent(chan->dev,
> -		(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS),
> +		((size_t)(2 * ZYNQMP_DMA_DESC_SIZE(chan)) *
> +		 ZYNQMP_DMA_NUM_DESCS),
>  		chan->desc_pool_v, chan->desc_pool_p);
>  	kfree(chan->sw_desc_pool);
>  	pm_runtime_mark_last_busy(chan->dev);
> -- 
> 2.17.1

-- 
~Vinod

[PATCH 2/4] dmaengine: zynqmp_dma: Typecast the variable with dma_addr_t to handle overflow

[Harini Katakam]

From: Shravya Kumbham <shravya.kumbham@xilinx.com>

In zynqmp_dma_alloc_chan_resources function there is a potential
overflow in the below expression.

desc->src_p = chan->desc_pool_p + (i * ZYNQMP_DMA_DESC_SIZE(chan*2);

The macro ZYNQMP_DMA_DESC_SIZE and variable i are 32-bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by using typecast.

Addresses-Coverity: Event overflow_before_widen.
Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
 drivers/dma/xilinx/zynqmp_dma.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 2d0eba25739d..d28b9ffb4309 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -502,7 +502,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan)
 					(i * ZYNQMP_DMA_DESC_SIZE(chan) * 2));
 		desc->dst_v = (struct zynqmp_dma_desc_ll *) (desc->src_v + 1);
 		desc->src_p = chan->desc_pool_p +
-				(i * ZYNQMP_DMA_DESC_SIZE(chan) * 2);
+				((dma_addr_t)i * ZYNQMP_DMA_DESC_SIZE(chan)
+				 * 2);
 		desc->dst_p = desc->src_p + ZYNQMP_DMA_DESC_SIZE(chan);
 	}
 
-- 
2.17.1

[PATCH 3/4] dmaengine: zynqmp_dma: Add conditions for return value check

[Harini Katakam]

From: Shravya Kumbham <shravya.kumbham@xilinx.com>

Add condition to check the return value of dma_async_device_register
and pm_runtime_get_sync functions.

Addresses-Coverity: Event check_return.
Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
 drivers/dma/xilinx/zynqmp_dma.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index d28b9ffb4309..588460e56ab8 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -1080,7 +1080,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
 	pm_runtime_set_autosuspend_delay(zdev->dev, ZDMA_PM_TIMEOUT);
 	pm_runtime_use_autosuspend(zdev->dev);
 	pm_runtime_enable(zdev->dev);
-	pm_runtime_get_sync(zdev->dev);
+	ret = pm_runtime_get_sync(zdev->dev);
+	if (ret < 0) {
+		dev_err(zdev->dev, "pm_runtime_get_sync() failed\n");
+		pm_runtime_disable(zdev->dev);
+	}
 	if (!pm_runtime_enabled(zdev->dev)) {
 		ret = zynqmp_dma_runtime_resume(zdev->dev);
 		if (ret)
@@ -1096,7 +1100,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
 	p->dst_addr_widths = BIT(zdev->chan->bus_width / 8);
 	p->src_addr_widths = BIT(zdev->chan->bus_width / 8);
 
-	dma_async_device_register(&zdev->common);
+	ret = dma_async_device_register(&zdev->common);
+	if (ret) {
+		dev_err(zdev->dev, "failed to register the dma device\n");
+		goto free_chan_resources;
+	}
 
 	ret = of_dma_controller_register(pdev->dev.of_node,
 					 of_zynqmp_dma_xlate, zdev);
-- 
2.17.1

Re: [PATCH 3/4] dmaengine: zynqmp_dma: Add conditions for return value check

[Michael Tretter]

On Tue, 14 Sep 2021 13:58:16 +0530, Harini Katakam wrote:
> From: Shravya Kumbham <shravya.kumbham@xilinx.com>
> 
> Add condition to check the return value of dma_async_device_register
> and pm_runtime_get_sync functions.
> 
> Addresses-Coverity: Event check_return.
> Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
> ---
>  drivers/dma/xilinx/zynqmp_dma.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
> index d28b9ffb4309..588460e56ab8 100644
> --- a/drivers/dma/xilinx/zynqmp_dma.c
> +++ b/drivers/dma/xilinx/zynqmp_dma.c
> @@ -1080,7 +1080,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
>  	pm_runtime_set_autosuspend_delay(zdev->dev, ZDMA_PM_TIMEOUT);
>  	pm_runtime_use_autosuspend(zdev->dev);
>  	pm_runtime_enable(zdev->dev);
> -	pm_runtime_get_sync(zdev->dev);
> +	ret = pm_runtime_get_sync(zdev->dev);
> +	if (ret < 0) {
> +		dev_err(zdev->dev, "pm_runtime_get_sync() failed\n");
> +		pm_runtime_disable(zdev->dev);
> +	}

Thanks for the patch.

You need to call pm_runtime_put() on the error path. Or you could use
pm_runtime_resume_and_get(), which does this automatically.

I am wondering, if it wouldn't be cleaner to make this dependent on
pm_runtime_enabled() and avoiding pm_runtime_disable() on the error path
altogether.

Michael

>  	if (!pm_runtime_enabled(zdev->dev)) {
>  		ret = zynqmp_dma_runtime_resume(zdev->dev);
>  		if (ret)
> @@ -1096,7 +1100,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
>  	p->dst_addr_widths = BIT(zdev->chan->bus_width / 8);
>  	p->src_addr_widths = BIT(zdev->chan->bus_width / 8);
>  
> -	dma_async_device_register(&zdev->common);
> +	ret = dma_async_device_register(&zdev->common);
> +	if (ret) {
> +		dev_err(zdev->dev, "failed to register the dma device\n");
> +		goto free_chan_resources;
> +	}
>  
>  	ret = of_dma_controller_register(pdev->dev.of_node,
>  					 of_zynqmp_dma_xlate, zdev);
> -- 
> 2.17.1
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
> 

Re: [PATCH 3/4] dmaengine: zynqmp_dma: Add conditions for return value check

[Vinod Koul]

On 14-09-21, 13:58, Harini Katakam wrote:
> From: Shravya Kumbham <shravya.kumbham@xilinx.com>
> 
> Add condition to check the return value of dma_async_device_register
> and pm_runtime_get_sync functions.
> 
> Addresses-Coverity: Event check_return.
> Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>

sob missing

> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
> ---
>  drivers/dma/xilinx/zynqmp_dma.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
> index d28b9ffb4309..588460e56ab8 100644
> --- a/drivers/dma/xilinx/zynqmp_dma.c
> +++ b/drivers/dma/xilinx/zynqmp_dma.c
> @@ -1080,7 +1080,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
>  	pm_runtime_set_autosuspend_delay(zdev->dev, ZDMA_PM_TIMEOUT);
>  	pm_runtime_use_autosuspend(zdev->dev);
>  	pm_runtime_enable(zdev->dev);
> -	pm_runtime_get_sync(zdev->dev);
> +	ret = pm_runtime_get_sync(zdev->dev);
> +	if (ret < 0) {
> +		dev_err(zdev->dev, "pm_runtime_get_sync() failed\n");
> +		pm_runtime_disable(zdev->dev);

disable is okay but it wont fix the count, you should call put and then
disable if required

> +	}
>  	if (!pm_runtime_enabled(zdev->dev)) {
>  		ret = zynqmp_dma_runtime_resume(zdev->dev);
>  		if (ret)
> @@ -1096,7 +1100,11 @@ static int zynqmp_dma_probe(struct platform_device *pdev)
>  	p->dst_addr_widths = BIT(zdev->chan->bus_width / 8);
>  	p->src_addr_widths = BIT(zdev->chan->bus_width / 8);
>  
> -	dma_async_device_register(&zdev->common);
> +	ret = dma_async_device_register(&zdev->common);
> +	if (ret) {
> +		dev_err(zdev->dev, "failed to register the dma device\n");
> +		goto free_chan_resources;
> +	}
>  
>  	ret = of_dma_controller_register(pdev->dev.of_node,
>  					 of_zynqmp_dma_xlate, zdev);
> -- 
> 2.17.1

-- 
~Vinod

[PATCH 4/4] dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning

[Harini Katakam]

From: Shravya Kumbham <shravya.kumbham@xilinx.com>

Typecast the flags variable with (enum dma_ctrl_flags) in
zynqmp_dma_prep_memcpy function to fix the coverity warning.

Addresses-Coverity: Event mixed_enum_type.
Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
---
 drivers/dma/xilinx/zynqmp_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
index 588460e56ab8..282d01ab402f 100644
--- a/drivers/dma/xilinx/zynqmp_dma.c
+++ b/drivers/dma/xilinx/zynqmp_dma.c
@@ -849,7 +849,7 @@ static struct dma_async_tx_descriptor *zynqmp_dma_prep_memcpy(
 
 	zynqmp_dma_desc_config_eod(chan, desc);
 	async_tx_ack(&first->async_tx);
-	first->async_tx.flags = flags;
+	first->async_tx.flags = (enum dma_ctrl_flags)flags;
 	return &first->async_tx;
 }
 
-- 
2.17.1

Re: [PATCH 4/4] dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning

[Michael Tretter]

On Tue, 14 Sep 2021 13:58:17 +0530, Harini Katakam wrote:
> From: Shravya Kumbham <shravya.kumbham@xilinx.com>
> 
> Typecast the flags variable with (enum dma_ctrl_flags) in
> zynqmp_dma_prep_memcpy function to fix the coverity warning.
> 
> Addresses-Coverity: Event mixed_enum_type.
> Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com>
> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
> ---
>  drivers/dma/xilinx/zynqmp_dma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c
> index 588460e56ab8..282d01ab402f 100644
> --- a/drivers/dma/xilinx/zynqmp_dma.c
> +++ b/drivers/dma/xilinx/zynqmp_dma.c
> @@ -849,7 +849,7 @@ static struct dma_async_tx_descriptor *zynqmp_dma_prep_memcpy(
>  
>  	zynqmp_dma_desc_config_eod(chan, desc);
>  	async_tx_ack(&first->async_tx);
> -	first->async_tx.flags = flags;
> +	first->async_tx.flags = (enum dma_ctrl_flags)flags;

Thanks for the patch.

I looked at a few dmaengine drivers, at it looks like all of them have this
issue. Maybe we should change the signature of the dmaengine_prep_dma_memcpy()
engine to accept "enum dma_ctrl_flags flags" instead of "unsigned long flags"?

Michael

>  	return &first->async_tx;
>  }
>  
> -- 
> 2.17.1
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
>