Skip to content

Commit fcc481f

Browse files
torvaldstorvalds
committed
Merge tag 'dmaengine-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine fixes from Vinod Koul: - Mediatek flag reuse error fix - Array overbound fix for nbpfaxi - Frame size warning in driver probe * tag 'dmaengine-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dma: dw-edma: Fix build warning in dw_edma_pcie_probe() dmaengine: nbpfaxi: Fix memory corruption in probe() dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
2 parents 5b35eb8 + 3df63fa commit fcc481f

File tree

3 files changed

+39
-36
lines changed

3 files changed

+39
-36
lines changed

‎drivers/dma/dw-edma/dw-edma-pcie.c

Lines changed: 32 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -161,36 +161,40 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
161161
const struct pci_device_id *pid)
162162
{
163163
struct dw_edma_pcie_data *pdata = (void *)pid->driver_data;
164-
struct dw_edma_pcie_data vsec_data;
164+
struct dw_edma_pcie_data *vsec_data __free(kfree) = NULL;
165165
struct device *dev = &pdev->dev;
166166
struct dw_edma_chip *chip;
167167
int err, nr_irqs;
168168
int i, mask;
169169

170+
vsec_data = kmalloc(sizeof(*vsec_data), GFP_KERNEL);
171+
if (!vsec_data)
172+
return -ENOMEM;
173+
170174
/* Enable PCI device */
171175
err = pcim_enable_device(pdev);
172176
if (err) {
173177
pci_err(pdev, "enabling device failed\n");
174178
return err;
175179
}
176180

177-
memcpy(&vsec_data, pdata, sizeof(struct dw_edma_pcie_data));
181+
memcpy(vsec_data, pdata, sizeof(struct dw_edma_pcie_data));
178182

179183
/*
180184
* Tries to find if exists a PCIe Vendor-Specific Extended Capability
181185
* for the DMA, if one exists, then reconfigures it.
182186
*/
183-
dw_edma_pcie_get_vsec_dma_data(pdev, &vsec_data);
187+
dw_edma_pcie_get_vsec_dma_data(pdev, vsec_data);
184188

185189
/* Mapping PCI BAR regions */
186-
mask = BIT(vsec_data.rg.bar);
187-
for (i = 0; i < vsec_data.wr_ch_cnt; i++) {
188-
mask |= BIT(vsec_data.ll_wr[i].bar);
189-
mask |= BIT(vsec_data.dt_wr[i].bar);
190+
mask = BIT(vsec_data->rg.bar);
191+
for (i = 0; i < vsec_data->wr_ch_cnt; i++) {
192+
mask |= BIT(vsec_data->ll_wr[i].bar);
193+
mask |= BIT(vsec_data->dt_wr[i].bar);
190194
}
191-
for (i = 0; i < vsec_data.rd_ch_cnt; i++) {
192-
mask |= BIT(vsec_data.ll_rd[i].bar);
193-
mask |= BIT(vsec_data.dt_rd[i].bar);
195+
for (i = 0; i < vsec_data->rd_ch_cnt; i++) {
196+
mask |= BIT(vsec_data->ll_rd[i].bar);
197+
mask |= BIT(vsec_data->dt_rd[i].bar);
194198
}
195199
err = pcim_iomap_regions(pdev, mask, pci_name(pdev));
196200
if (err) {
@@ -213,7 +217,7 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
213217
return -ENOMEM;
214218

215219
/* IRQs allocation */
216-
nr_irqs = pci_alloc_irq_vectors(pdev, 1, vsec_data.irqs,
220+
nr_irqs = pci_alloc_irq_vectors(pdev, 1, vsec_data->irqs,
217221
PCI_IRQ_MSI | PCI_IRQ_MSIX);
218222
if (nr_irqs < 1) {
219223
pci_err(pdev, "fail to alloc IRQ vector (number of IRQs=%u)\n",
@@ -224,22 +228,22 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
224228
/* Data structure initialization */
225229
chip->dev = dev;
226230

227-
chip->mf = vsec_data.mf;
231+
chip->mf = vsec_data->mf;
228232
chip->nr_irqs = nr_irqs;
229233
chip->ops = &dw_edma_pcie_plat_ops;
230234

231-
chip->ll_wr_cnt = vsec_data.wr_ch_cnt;
232-
chip->ll_rd_cnt = vsec_data.rd_ch_cnt;
235+
chip->ll_wr_cnt = vsec_data->wr_ch_cnt;
236+
chip->ll_rd_cnt = vsec_data->rd_ch_cnt;
233237

234-
chip->reg_base = pcim_iomap_table(pdev)[vsec_data.rg.bar];
238+
chip->reg_base = pcim_iomap_table(pdev)[vsec_data->rg.bar];
235239
if (!chip->reg_base)
236240
return -ENOMEM;
237241

238242
for (i = 0; i < chip->ll_wr_cnt; i++) {
239243
struct dw_edma_region *ll_region = &chip->ll_region_wr[i];
240244
struct dw_edma_region *dt_region = &chip->dt_region_wr[i];
241-
struct dw_edma_block *ll_block = &vsec_data.ll_wr[i];
242-
struct dw_edma_block *dt_block = &vsec_data.dt_wr[i];
245+
struct dw_edma_block *ll_block = &vsec_data->ll_wr[i];
246+
struct dw_edma_block *dt_block = &vsec_data->dt_wr[i];
243247

244248
ll_region->vaddr.io = pcim_iomap_table(pdev)[ll_block->bar];
245249
if (!ll_region->vaddr.io)
@@ -263,8 +267,8 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
263267
for (i = 0; i < chip->ll_rd_cnt; i++) {
264268
struct dw_edma_region *ll_region = &chip->ll_region_rd[i];
265269
struct dw_edma_region *dt_region = &chip->dt_region_rd[i];
266-
struct dw_edma_block *ll_block = &vsec_data.ll_rd[i];
267-
struct dw_edma_block *dt_block = &vsec_data.dt_rd[i];
270+
struct dw_edma_block *ll_block = &vsec_data->ll_rd[i];
271+
struct dw_edma_block *dt_block = &vsec_data->dt_rd[i];
268272

269273
ll_region->vaddr.io = pcim_iomap_table(pdev)[ll_block->bar];
270274
if (!ll_region->vaddr.io)
@@ -298,31 +302,31 @@ static int dw_edma_pcie_probe(struct pci_dev *pdev,
298302
pci_dbg(pdev, "Version:\tUnknown (0x%x)\n", chip->mf);
299303

300304
pci_dbg(pdev, "Registers:\tBAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p)\n",
301-
vsec_data.rg.bar, vsec_data.rg.off, vsec_data.rg.sz,
305+
vsec_data->rg.bar, vsec_data->rg.off, vsec_data->rg.sz,
302306
chip->reg_base);
303307

304308

305309
for (i = 0; i < chip->ll_wr_cnt; i++) {
306310
pci_dbg(pdev, "L. List:\tWRITE CH%.2u, BAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
307-
i, vsec_data.ll_wr[i].bar,
308-
vsec_data.ll_wr[i].off, chip->ll_region_wr[i].sz,
311+
i, vsec_data->ll_wr[i].bar,
312+
vsec_data->ll_wr[i].off, chip->ll_region_wr[i].sz,
309313
chip->ll_region_wr[i].vaddr.io, &chip->ll_region_wr[i].paddr);
310314

311315
pci_dbg(pdev, "Data:\tWRITE CH%.2u, BAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
312-
i, vsec_data.dt_wr[i].bar,
313-
vsec_data.dt_wr[i].off, chip->dt_region_wr[i].sz,
316+
i, vsec_data->dt_wr[i].bar,
317+
vsec_data->dt_wr[i].off, chip->dt_region_wr[i].sz,
314318
chip->dt_region_wr[i].vaddr.io, &chip->dt_region_wr[i].paddr);
315319
}
316320

317321
for (i = 0; i < chip->ll_rd_cnt; i++) {
318322
pci_dbg(pdev, "L. List:\tREAD CH%.2u, BAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
319-
i, vsec_data.ll_rd[i].bar,
320-
vsec_data.ll_rd[i].off, chip->ll_region_rd[i].sz,
323+
i, vsec_data->ll_rd[i].bar,
324+
vsec_data->ll_rd[i].off, chip->ll_region_rd[i].sz,
321325
chip->ll_region_rd[i].vaddr.io, &chip->ll_region_rd[i].paddr);
322326

323327
pci_dbg(pdev, "Data:\tREAD CH%.2u, BAR=%u, off=0x%.8lx, sz=0x%zx bytes, addr(v=%p, p=%pa)\n",
324-
i, vsec_data.dt_rd[i].bar,
325-
vsec_data.dt_rd[i].off, chip->dt_region_rd[i].sz,
328+
i, vsec_data->dt_rd[i].bar,
329+
vsec_data->dt_rd[i].off, chip->dt_region_rd[i].sz,
326330
chip->dt_region_rd[i].vaddr.io, &chip->dt_region_rd[i].paddr);
327331
}
328332

‎drivers/dma/mediatek/mtk-cqdma.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -449,9 +449,9 @@ static enum dma_status mtk_cqdma_tx_status(struct dma_chan *c,
449449
return ret;
450450

451451
spin_lock_irqsave(&cvc->pc->lock, flags);
452-
spin_lock_irqsave(&cvc->vc.lock, flags);
452+
spin_lock(&cvc->vc.lock);
453453
vd = mtk_cqdma_find_active_desc(c, cookie);
454-
spin_unlock_irqrestore(&cvc->vc.lock, flags);
454+
spin_unlock(&cvc->vc.lock);
455455
spin_unlock_irqrestore(&cvc->pc->lock, flags);
456456

457457
if (vd) {

‎drivers/dma/nbpfaxi.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1351,7 +1351,7 @@ static int nbpf_probe(struct platform_device *pdev)
13511351
if (irqs == 1) {
13521352
eirq = irqbuf[0];
13531353

1354-
for (i = 0; i <= num_channels; i++)
1354+
for (i = 0; i < num_channels; i++)
13551355
nbpf->chan[i].irq = irqbuf[0];
13561356
} else {
13571357
eirq = platform_get_irq_byname(pdev, "error");
@@ -1361,24 +1361,23 @@ static int nbpf_probe(struct platform_device *pdev)
13611361
if (irqs == num_channels + 1) {
13621362
struct nbpf_channel *chan;
13631363

1364-
for (i = 0, chan = nbpf->chan; i <= num_channels;
1364+
for (i = 0, chan = nbpf->chan; i < num_channels;
13651365
i++, chan++) {
13661366
/* Skip the error IRQ */
13671367
if (irqbuf[i] == eirq)
13681368
i++;
1369+
if (i >= ARRAY_SIZE(irqbuf))
1370+
return -EINVAL;
13691371
chan->irq = irqbuf[i];
13701372
}
1371-
1372-
if (chan != nbpf->chan + num_channels)
1373-
return -EINVAL;
13741373
} else {
13751374
/* 2 IRQs and more than one channel */
13761375
if (irqbuf[0] == eirq)
13771376
irq = irqbuf[1];
13781377
else
13791378
irq = irqbuf[0];
13801379

1381-
for (i = 0; i <= num_channels; i++)
1380+
for (i = 0; i < num_channels; i++)
13821381
nbpf->chan[i].irq = irq;
13831382
}
13841383
}

0 commit comments

Comments
 (0)