Sven Van Asbroeck
9b8a4a188a
dmaengine: imx-sdma: fix use-after-free on probe error path ...
[ Upstream commit 2b8066c3deb9140fdf258417a51479b2aeaa7622 ]
If probe() fails anywhere beyond the point where
sdma_get_firmware() is called, then a kernel oops may occur.
Problematic sequence of events:
1. probe() calls sdma_get_firmware(), which schedules the
firmware callback to run when firmware becomes available,
using the sdma instance structure as the context
2. probe() encounters an error, which deallocates the
sdma instance structure
3. firmware becomes available, firmware callback is
called with deallocated sdma instance structure
4. use after free - kernel oops !
Solution: only attempt to load firmware when we're certain
that probe() will succeed. This guarantees that the firmware
callback's context will remain valid.
Note that the remove() path is unaffected by this issue: the
firmware loader will increment the driver module's use count,
ensuring that the module cannot be unloaded while the
firmware callback is pending or running.
Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
Reviewed-by: Robin Gong <yibin.gong@nxp.com>
[vkoul: fixed braces for if condition]
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-08-04 09:33:14 +02:00
dmaengine: NO_IRQ removal from powerpc-only drivers
2016-09-14 18:57:38 +05:30
dmaengine updates for 4.8-rc1
2016-10-06 17:13:54 -07:00
dmaengine: hsu: refactor hsu_dma_do_irq() to return int
2016-09-15 21:15:40 +05:30
driver/dma/ioat: Call del_timer_sync() without holding prep_lock
2018-11-13 11:16:53 -08:00
dmaengine: ipu: Make sure the interrupt routine checks all interrupts.
2017-03-12 06:41:52 +01:00
Merge branch 'topic/unmap_cleanup' into for-linus
2016-10-03 09:36:11 +05:30
dmaengine: qcom_hidma: assign channel cookie correctly
2019-04-05 22:29:14 +02:00
dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
2019-05-02 09:32:02 +02:00
dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
2019-02-12 19:44:52 +01:00
dmaengine: Remove site specific OOM error messages on kzalloc
2016-06-21 21:35:00 +05:30
dmaengine: at_hdmac: fix module unloading
2018-12-05 19:42:40 +01:00
dmaengine: at_xdmac: remove BUG_ON macro in tasklet
2019-05-31 06:48:18 -07:00
dmaengine: bcm2835: Fix abort of transactions
2019-02-12 19:45:00 +01:00
Merge branch 'topic/err_reporting' into for-linus
2016-10-03 09:17:33 +05:30
dmaengine: coh901318: use NULL for pointer initialization
2016-09-26 22:28:24 +05:30
dmaengine: cppi41: delete channel from pending list when stop channel
2018-12-13 09:20:29 +01:00
dmaengine: axi-dmac: Return IRQ_NONE if no IRQs are pending
2016-07-01 22:56:41 +05:30
dmaengine: jz4740: disable/unprepare clk if probe fails
2018-02-25 11:05:49 +01:00
dmaengine: dma-jz4780: Return error if not probed from DT
2018-11-13 11:16:53 -08:00
dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
2017-12-20 10:07:21 +01:00
dmaengine: add support to provide error result from a DMA transation
2016-08-08 08:11:42 +05:30
dmaengine: dmatest: Abort test in case of mapping error
2019-03-13 14:05:00 -07:00
dmaengine: edma: Align the memcpy acnt array size with the transfer
2017-10-18 09:35:38 +02:00
dmaengine: ep93xx: Don't drain the transfers in terminate_all()
2017-06-14 15:05:57 +02:00
dmaengine: fsl-edma: disable clks on all error paths
2018-03-03 10:23:20 +01:00
dmaengine updates for 4.8-rc1
2016-10-06 17:13:54 -07:00
Merge branch 'topic/unmap_cleanup' into for-linus
2016-10-03 09:36:11 +05:30
dmaengine: idma64: Use actual device for DMA transfers
2019-06-22 08:17:17 +02:00
dmaengine: idma64: Use actual device for DMA transfers
2019-06-22 08:17:17 +02:00
dmaengine: img-mdc: fix a possible NULL dereference
2016-08-22 11:57:49 +05:30
dmaengine: imx-dma: fix warning comparison of distinct pointer types
2019-04-05 22:29:14 +02:00
dmaengine: imx-sdma: fix use-after-free on probe error path
2019-08-04 09:33:14 +02:00
dmaengine: iop-adma: convert callback to helper function
2016-08-08 08:11:39 +05:30
dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
2018-08-24 13:12:33 +02:00
dmaengine: mmp_tdma: add missing select GENERIC_ALLOCATOR in Kconfig
2016-10-18 20:32:56 +05:30
dmaengine: mv_xor_v2: new driver
2016-07-12 10:09:53 +05:30
dmaengine: mic_x100_dma: convert callback to helper function
2016-08-08 08:11:39 +05:30
dmaengine: mmp_pdma: convert callback to helper function
2016-08-08 08:11:39 +05:30
Merge branch 'topic/err_reporting' into for-linus
2016-10-03 09:17:33 +05:30
dmaengine: moxart: remove NO_IRQ
2016-09-05 16:40:52 +05:30
Merge branch 'topic/err_reporting' into for-linus
2016-10-03 09:17:33 +05:30
Merge branch 'topic/unmap_cleanup' into for-linus
2016-10-03 09:36:11 +05:30
dmaengine: mv_xor: Add support for IO (PCIe) src/dst areas
2016-09-15 21:13:59 +05:30
dmaengine: mv_xor_v2: kill the tasklets upon exit
2018-09-26 08:36:34 +02:00
Merge branch 'topic/no_irq' into for-linus
2016-10-03 09:18:29 +05:30
dmaengine: nbpfaxi: convert callback to helper function
2016-08-08 08:11:40 +05:30
dmaengine: of_dma: approximate an average distribution
2016-05-14 13:34:10 +05:30
dmaengine: omap-dma: Fix dynamic lch_map allocation
2017-01-19 20:18:03 +01:00
dmaengine: pch_dma: convert callback to helper function
2016-08-08 08:11:40 +05:30
dmaengine: pl330: _stop: clear interrupt status
2019-05-31 06:48:15 -07:00
dmaengine: pxa_dma: fix debug message
2016-08-19 16:17:26 +05:30
Merge branch 'topic/compile_test' into for-linus
2016-10-03 09:16:03 +05:30
dmaengine: sa11x0: use correct print specifiers for size_t
2016-09-26 22:29:26 +05:30
Merge branch 'topic/no_irq' into for-linus
2016-10-03 09:18:29 +05:30
Merge branch 'topic/ste_dma40' into for-linus
2016-10-03 09:35:55 +05:30
dmaengine: ste_dma40_ll: make d40_width_to_bits static
2016-06-08 08:59:55 +05:30
dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status
2017-12-09 22:01:50 +01:00
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
dmaengine: sun6i: fix the uninitialized value for v_lli
2016-11-14 10:35:58 +05:30
dmaengine: tegra: avoid overflow of byte tracking
2019-04-05 22:29:15 +02:00
dmaengine: tegra210-adma: use devm_clk_*() helpers
2019-05-31 06:48:30 -07:00
dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
2018-03-24 11:00:26 +01:00
dmaengine: timb_dma: convert callback to helper function
2016-08-08 08:11:41 +05:30
dmaengine: txx9dmac: convert callback to helper function
2016-08-08 08:11:41 +05:30
dmaengine: virt-dma: convert callback to helper function
2016-08-08 08:11:41 +05:30
dmaengine: virt-dma: move function declarations
2016-10-01 11:41:39 +05:30
dmaengine: xgene-dma: move unmap to before callback
2016-08-08 08:11:43 +05:30
dmaengine: zx: fix build warning
2018-02-25 11:05:53 +01:00
9b8a4a188a