superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/kernel/dma
History
Shanker Donthineni c33efdfcfa dma: contiguous: Check return value of dma_contiguous_reserve_area() 
Commit 8f1fc1bf1a ("dma: contiguous: Reserve default CMA heap")
introduced a bug where dma_heap_cma_register_heap() is called with
a NULL pointer when dma_contiguous_reserve_area() fails to reserve
the CMA area.

When dma_contiguous_reserve_area() fails, dma_contiguous_default_area
remains NULL (initialized as a global variable), but the code doesn't
check the return value and proceeds to call dma_heap_cma_register_heap()
with this NULL pointer.

Later during boot, add_cma_heaps() iterates through the dma_areas[]
array and attempts to register heaps. When it encounters the NULL
pointer stored by the earlier call, it crashes in __add_cma_heap()
-> dma_heap_add() when trying to dereference the NULL CMA pointer.

The crash manifests as:
  Unable to handle kernel NULL pointer dereference at virtual address
  0000000000000038
  ...
  Call trace:
   dma_heap_add+0x40/0x2b0
   __add_cma_heap+0x80/0xe0
   add_cma_heaps+0x64/0xb0
   do_one_initcall+0x60/0x318
   kernel_init_freeable+0x260/0x2f0
   kernel_init+0x2c/0x168
   ret_from_fork+0x10/0x20

Fix this by checking the return value of dma_contiguous_reserve_area()
and only calling dma_heap_cma_register_heap() when the reservation
succeeds.

Fixes: 8f1fc1bf1a ("dma: contiguous: Reserve default CMA heap")
Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20260129181317.2429196-1-sdonthineni@nvidia.com
 		2026-02-02 09:20:32 +01:00
..
Kconfig dma-debug: remove DMA_API_DEBUG_SG 2024-10-29 08:53:37 +01:00
Makefile dma-mapping: clearly mark DMA ops as an architecture feature 2024-09-04 07:08:51 +03:00
coherent.c dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask 2025-04-22 17:44:09 +02:00
contiguous.c dma: contiguous: Check return value of dma_contiguous_reserve_area() 2026-02-02 09:20:32 +01:00
debug.c dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC 2025-10-15 13:24:33 -07:00
debug.h dma-mapping: export new dma_*map_phys() interface 2025-09-12 00:18:21 +02:00
direct.c VFIO updates for v6.19-rc1 2025-12-04 18:42:48 -08:00
direct.h dma-mapping: convert dma_direct_*map_page to be phys_addr_t based 2025-09-12 00:18:20 +02:00
dummy.c dma-mapping: convert dummy ops to physical address mapping 2025-10-29 10:27:29 +01:00
map_benchmark.c tools/dma: move dma_map_benchmark from selftests to tools/dma 2025-10-29 09:41:40 +01:00
mapping.c dma-mapping: remove unused map_page callback 2025-10-29 10:27:31 +01:00
ops_helpers.c dma-mapping: remove unused map_page callback 2025-10-29 10:27:31 +01:00
pool.c dma/pool: distinguish between missing and exhausted atomic pools 2026-01-29 10:23:45 +01:00
remap.c dma-remap: drop nth_page() in dma_common_contiguous_remap() 2025-09-21 14:22:06 -07:00
swiotlb.c mm: make INVALID_PHYS_ADDR a generic macro 2025-11-16 17:28:26 -08:00