Commit 7edfe3df authored by Alan Mikhak's avatar Alan Mikhak Committed by Vinod Koul

dmaengine: dw-edma: Check MSI descriptor before copying

Modify dw_edma_irq_request() to check if a struct msi_desc entry exists
before copying the contents of its struct msi_msg pointer.

Without this sanity check, __get_cached_msi_msg() crashes when invoked by
dw_edma_irq_request() running on a Linux-based PCIe endpoint device. MSI
interrupt are not received by PCIe endpoint devices. If irq_get_msi_desc()
returns null, then there is no cached struct msi_msg to be copied.
Reported-by: default avatarkbuild test robot <lkp@intel.com>
Signed-off-by: default avatarAlan Mikhak <alan.mikhak@sifive.com>
Acked-by: default avatarGustavo Pimentel <gustavo.pimentel@synopsys.com>
Link: https://lore.kernel.org/r/1587607101-31914-1-git-send-email-alan.mikhak@sifive.comSigned-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent db474931
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
#include <linux/dmaengine.h> #include <linux/dmaengine.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/interrupt.h> #include <linux/interrupt.h>
#include <linux/irq.h>
#include <linux/dma/edma.h> #include <linux/dma/edma.h>
#include <linux/dma-mapping.h> #include <linux/dma-mapping.h>
...@@ -773,6 +774,7 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip, ...@@ -773,6 +774,7 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip,
u32 rd_mask = 1; u32 rd_mask = 1;
int i, err = 0; int i, err = 0;
u32 ch_cnt; u32 ch_cnt;
int irq;
ch_cnt = dw->wr_ch_cnt + dw->rd_ch_cnt; ch_cnt = dw->wr_ch_cnt + dw->rd_ch_cnt;
...@@ -781,16 +783,16 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip, ...@@ -781,16 +783,16 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip,
if (dw->nr_irqs == 1) { if (dw->nr_irqs == 1) {
/* Common IRQ shared among all channels */ /* Common IRQ shared among all channels */
err = request_irq(dw->ops->irq_vector(dev, 0), irq = dw->ops->irq_vector(dev, 0);
dw_edma_interrupt_common, err = request_irq(irq, dw_edma_interrupt_common,
IRQF_SHARED, dw->name, &dw->irq[0]); IRQF_SHARED, dw->name, &dw->irq[0]);
if (err) { if (err) {
dw->nr_irqs = 0; dw->nr_irqs = 0;
return err; return err;
} }
get_cached_msi_msg(dw->ops->irq_vector(dev, 0), if (irq_get_msi_desc(irq))
&dw->irq[0].msi); get_cached_msi_msg(irq, &dw->irq[0].msi);
} else { } else {
/* Distribute IRQs equally among all channels */ /* Distribute IRQs equally among all channels */
int tmp = dw->nr_irqs; int tmp = dw->nr_irqs;
...@@ -804,7 +806,8 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip, ...@@ -804,7 +806,8 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip,
dw_edma_add_irq_mask(&rd_mask, *rd_alloc, dw->rd_ch_cnt); dw_edma_add_irq_mask(&rd_mask, *rd_alloc, dw->rd_ch_cnt);
for (i = 0; i < (*wr_alloc + *rd_alloc); i++) { for (i = 0; i < (*wr_alloc + *rd_alloc); i++) {
err = request_irq(dw->ops->irq_vector(dev, i), irq = dw->ops->irq_vector(dev, i);
err = request_irq(irq,
i < *wr_alloc ? i < *wr_alloc ?
dw_edma_interrupt_write : dw_edma_interrupt_write :
dw_edma_interrupt_read, dw_edma_interrupt_read,
...@@ -815,8 +818,8 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip, ...@@ -815,8 +818,8 @@ static int dw_edma_irq_request(struct dw_edma_chip *chip,
return err; return err;
} }
get_cached_msi_msg(dw->ops->irq_vector(dev, i), if (irq_get_msi_desc(irq))
&dw->irq[i].msi); get_cached_msi_msg(irq, &dw->irq[i].msi);
} }
dw->nr_irqs = i; dw->nr_irqs = i;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment