remoteproc: fix a potential NULL-dereference on cleanup
We only need to allocate mapping if there is an IOMMU domain. Otherwise, when the mappings are released, the assumption that an IOMMU domain is there will crash and burn. CC: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> [ohad: revise commit log] Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
This commit is contained in:
parent
2ed6d29c72
commit
7168d914a7
|
@ -573,17 +573,10 @@ static int rproc_handle_carveout(struct rproc *rproc,
|
||||||
dev_dbg(dev, "carveout rsc: da %x, pa %x, len %x, flags %x\n",
|
dev_dbg(dev, "carveout rsc: da %x, pa %x, len %x, flags %x\n",
|
||||||
rsc->da, rsc->pa, rsc->len, rsc->flags);
|
rsc->da, rsc->pa, rsc->len, rsc->flags);
|
||||||
|
|
||||||
mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
|
|
||||||
if (!mapping) {
|
|
||||||
dev_err(dev, "kzalloc mapping failed\n");
|
|
||||||
return -ENOMEM;
|
|
||||||
}
|
|
||||||
|
|
||||||
carveout = kzalloc(sizeof(*carveout), GFP_KERNEL);
|
carveout = kzalloc(sizeof(*carveout), GFP_KERNEL);
|
||||||
if (!carveout) {
|
if (!carveout) {
|
||||||
dev_err(dev, "kzalloc carveout failed\n");
|
dev_err(dev, "kzalloc carveout failed\n");
|
||||||
ret = -ENOMEM;
|
return -ENOMEM;
|
||||||
goto free_mapping;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
va = dma_alloc_coherent(dev->parent, rsc->len, &dma, GFP_KERNEL);
|
va = dma_alloc_coherent(dev->parent, rsc->len, &dma, GFP_KERNEL);
|
||||||
|
@ -613,11 +606,18 @@ static int rproc_handle_carveout(struct rproc *rproc,
|
||||||
* physical address in this case.
|
* physical address in this case.
|
||||||
*/
|
*/
|
||||||
if (rproc->domain) {
|
if (rproc->domain) {
|
||||||
|
mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
|
||||||
|
if (!mapping) {
|
||||||
|
dev_err(dev, "kzalloc mapping failed\n");
|
||||||
|
ret = -ENOMEM;
|
||||||
|
goto dma_free;
|
||||||
|
}
|
||||||
|
|
||||||
ret = iommu_map(rproc->domain, rsc->da, dma, rsc->len,
|
ret = iommu_map(rproc->domain, rsc->da, dma, rsc->len,
|
||||||
rsc->flags);
|
rsc->flags);
|
||||||
if (ret) {
|
if (ret) {
|
||||||
dev_err(dev, "iommu_map failed: %d\n", ret);
|
dev_err(dev, "iommu_map failed: %d\n", ret);
|
||||||
goto dma_free;
|
goto free_mapping;
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -662,12 +662,12 @@ static int rproc_handle_carveout(struct rproc *rproc,
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
free_mapping:
|
||||||
|
kfree(mapping);
|
||||||
dma_free:
|
dma_free:
|
||||||
dma_free_coherent(dev->parent, rsc->len, va, dma);
|
dma_free_coherent(dev->parent, rsc->len, va, dma);
|
||||||
free_carv:
|
free_carv:
|
||||||
kfree(carveout);
|
kfree(carveout);
|
||||||
free_mapping:
|
|
||||||
kfree(mapping);
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue