• Amelie Delaunay's avatar
    dmaengine: fix NULL pointer in channel unregistration function · f5c24d94
    Amelie Delaunay authored
    __dma_async_device_channel_register() can fail. In case of failure,
    chan->local is freed (with free_percpu()), and chan->local is nullified.
    When dma_async_device_unregister() is called (because of managed API or
    intentionally by DMA controller driver), channels are unconditionally
    unregistered, leading to this NULL pointer:
    [    1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
    [...]
    [    1.484499] Call trace:
    [    1.486930]  device_del+0x40/0x394
    [    1.490314]  device_unregister+0x20/0x7c
    [    1.494220]  __dma_async_device_channel_unregister+0x68/0xc0
    
    Look at dma_async_device_register() function error path, channel device
    unregistration is done only if chan->local is not NULL.
    
    Then add the same condition at the beginning of
    __dma_async_device_channel_unregister() function, to avoid NULL pointer
    issue whatever the API used to reach this function.
    
    Fixes: d2fb0a04 ("dmaengine: break out channel registration")
    Signed-off-by: default avatarAmelie Delaunay <amelie.delaunay@foss.st.com>
    Reviewed-by: default avatarDave Jiang <dave.jiang@intel.com>
    Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.comSigned-off-by: default avatarVinod Koul <vkoul@kernel.org>
    f5c24d94
dmaengine.c 39.6 KB