[v2] 8250_lpss: check null return when calling pci_ioremap_bar
diff mbox series

Message ID 20190719174848.24216-1-navid.emamdoost@gmail.com
State Superseded
Commit f5d6aadf3b6434f11393e33be9fd25a56d0bc872
Headers show
Series
  • [v2] 8250_lpss: check null return when calling pci_ioremap_bar
Related show

Commit Message

Navid Emamdoost July 19, 2019, 5:48 p.m. UTC
pci_ioremap_bar may return null. This is eventually de-referenced at 
drivers/dma/dw/core.c:1154 and drivers/dma/dw/core.c:1168. A null check 
is needed to prevent null de-reference. I am adding the check and in case
 of failure. Thanks to Andy Shevchenko for the hint on the necessity of 
pci_iounmap when exiting.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
---
 drivers/tty/serial/8250/8250_lpss.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

Andy Shevchenko July 19, 2019, 10:36 p.m. UTC | #1
On Sat, Jul 20, 2019 at 12:45 AM Navid Emamdoost
<navid.emamdoost@gmail.com> wrote:
>
> pci_ioremap_bar may return null. This is eventually de-referenced at
> drivers/dma/dw/core.c:1154 and drivers/dma/dw/core.c:1168. A null check
> is needed to prevent null de-reference. I am adding the check and in case
>  of failure. Thanks to Andy Shevchenko for the hint on the necessity of
> pci_iounmap when exiting.
>

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>

> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
> ---
>  drivers/tty/serial/8250/8250_lpss.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
> index 53ca9ba6ab4b..d07e431110d9 100644
> --- a/drivers/tty/serial/8250/8250_lpss.c
> +++ b/drivers/tty/serial/8250/8250_lpss.c
> @@ -169,10 +169,12 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
>         struct pci_dev *pdev = to_pci_dev(port->dev);
>         int ret;
>
> +       chip->pdata = &qrk_serial_dma_pdata;
>         chip->dev = &pdev->dev;
>         chip->irq = pci_irq_vector(pdev, 0);
>         chip->regs = pci_ioremap_bar(pdev, 1);
> -       chip->pdata = &qrk_serial_dma_pdata;
> +       if (!chip->regs)
> +               return;
>
>         /* Falling back to PIO mode if DMA probing fails */
>         ret = dw_dma_probe(chip);
> @@ -195,11 +197,15 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
>
>  static void qrk_serial_exit_dma(struct lpss8250 *lpss)
>  {
> +       struct dw_dma_chip *chip = &lpss->dma_chip;
>         struct dw_dma_slave *param = &lpss->dma_param;
>
>         if (!param->dma_dev)
>                 return;
> -       dw_dma_remove(&lpss->dma_chip);
> +
> +       dw_dma_remove(chip);
> +
> +       pci_iounmap(to_pci_dev(chip->dev), chip->regs);
>  }
>  #else  /* CONFIG_SERIAL_8250_DMA */
>  static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port) {}
> --
> 2.17.1
>
Bartlomiej Zolnierkiewicz July 26, 2019, 11:32 a.m. UTC | #2
Hi,

On 7/19/19 7:48 PM, Navid Emamdoost wrote:
> pci_ioremap_bar may return null. This is eventually de-referenced at 
> drivers/dma/dw/core.c:1154 and drivers/dma/dw/core.c:1168. A null check 
> is needed to prevent null de-reference. I am adding the check and in case
>  of failure. Thanks to Andy Shevchenko for the hint on the necessity of 
> pci_iounmap when exiting.
> 
> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
> ---
>  drivers/tty/serial/8250/8250_lpss.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
> index 53ca9ba6ab4b..d07e431110d9 100644
> --- a/drivers/tty/serial/8250/8250_lpss.c
> +++ b/drivers/tty/serial/8250/8250_lpss.c
> @@ -169,10 +169,12 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
>  	struct pci_dev *pdev = to_pci_dev(port->dev);
>  	int ret;
>  
> +	chip->pdata = &qrk_serial_dma_pdata;
>  	chip->dev = &pdev->dev;
>  	chip->irq = pci_irq_vector(pdev, 0);
>  	chip->regs = pci_ioremap_bar(pdev, 1);
> -	chip->pdata = &qrk_serial_dma_pdata;
> +	if (!chip->regs)
> +		return;
>  
>  	/* Falling back to PIO mode if DMA probing fails */
>  	ret = dw_dma_probe(chip);

pci_iounmap() should also be called on dw_dma_probe() failure (in such
case param->dma_dev is NULL so pci_iounmap() in qrk_serial_exit_dma()
won't be called during exit).

> @@ -195,11 +197,15 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
>  pci_iounmap
>  static void qrk_serial_exit_dma(struct lpss8250 *lpss)
>  {
> +	struct dw_dma_chip *chip = &lpss->dma_chip;
>  	struct dw_dma_slave *param = &lpss->dma_param;
>  
>  	if (!param->dma_dev)
>  		return;
> -	dw_dma_remove(&lpss->dma_chip);
> +
> +	dw_dma_remove(chip);
> +
> +	pci_iounmap(to_pci_dev(chip->dev), chip->regs);
>  }
>  #else	/* CONFIG_SERIAL_8250_DMA */
>  static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port) {}

Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
Andy Shevchenko July 26, 2019, 11:57 a.m. UTC | #3
On Fri, Jul 26, 2019 at 01:32:21PM +0200, Bartlomiej Zolnierkiewicz wrote:
> On 7/19/19 7:48 PM, Navid Emamdoost wrote:
> > pci_ioremap_bar may return null. This is eventually de-referenced at 
> > drivers/dma/dw/core.c:1154 and drivers/dma/dw/core.c:1168. A null check 
> > is needed to prevent null de-reference. I am adding the check and in case
> >  of failure. Thanks to Andy Shevchenko for the hint on the necessity of 
> > pci_iounmap when exiting.

> > @@ -169,10 +169,12 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
> >  	struct pci_dev *pdev = to_pci_dev(port->dev);
> >  	int ret;
> >  
> > +	chip->pdata = &qrk_serial_dma_pdata;
> >  	chip->dev = &pdev->dev;
> >  	chip->irq = pci_irq_vector(pdev, 0);
> >  	chip->regs = pci_ioremap_bar(pdev, 1);
> > -	chip->pdata = &qrk_serial_dma_pdata;
> > +	if (!chip->regs)
> > +		return;
> >  
> >  	/* Falling back to PIO mode if DMA probing fails */
> >  	ret = dw_dma_probe(chip);
> 
> pci_iounmap() should also be called on dw_dma_probe() failure (in such
> case param->dma_dev is NULL so pci_iounmap() in qrk_serial_exit_dma()
> won't be called during exit).

Oh, yes, good catch!
Navid, can you send a follow up fix?

> > @@ -195,11 +197,15 @@ static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
> >  pci_iounmap
> >  static void qrk_serial_exit_dma(struct lpss8250 *lpss)
> >  {
> > +	struct dw_dma_chip *chip = &lpss->dma_chip;
> >  	struct dw_dma_slave *param = &lpss->dma_param;
> >  
> >  	if (!param->dma_dev)
> >  		return;
> > -	dw_dma_remove(&lpss->dma_chip);
> > +
> > +	dw_dma_remove(chip);
> > +
> > +	pci_iounmap(to_pci_dev(chip->dev), chip->regs);
> >  }

Patch
diff mbox series

diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
index 53ca9ba6ab4b..d07e431110d9 100644
--- a/drivers/tty/serial/8250/8250_lpss.c
+++ b/drivers/tty/serial/8250/8250_lpss.c
@@ -169,10 +169,12 @@  static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
 	struct pci_dev *pdev = to_pci_dev(port->dev);
 	int ret;
 
+	chip->pdata = &qrk_serial_dma_pdata;
 	chip->dev = &pdev->dev;
 	chip->irq = pci_irq_vector(pdev, 0);
 	chip->regs = pci_ioremap_bar(pdev, 1);
-	chip->pdata = &qrk_serial_dma_pdata;
+	if (!chip->regs)
+		return;
 
 	/* Falling back to PIO mode if DMA probing fails */
 	ret = dw_dma_probe(chip);
@@ -195,11 +197,15 @@  static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port)
 
 static void qrk_serial_exit_dma(struct lpss8250 *lpss)
 {
+	struct dw_dma_chip *chip = &lpss->dma_chip;
 	struct dw_dma_slave *param = &lpss->dma_param;
 
 	if (!param->dma_dev)
 		return;
-	dw_dma_remove(&lpss->dma_chip);
+
+	dw_dma_remove(chip);
+
+	pci_iounmap(to_pci_dev(chip->dev), chip->regs);
 }
 #else	/* CONFIG_SERIAL_8250_DMA */
 static void qrk_serial_setup_dma(struct lpss8250 *lpss, struct uart_port *port) {}