kernel/drivers/dma/ti/edma.c, branch linux-rolling-stable

dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

2025-09-19T14:37:38Z

[ Upstream commit e63419dbf2ceb083c1651852209c7f048089ac0f ] Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure. Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/") Signed-off-by: Anders Roxell Link: https://lore.kernel.org/r/20250830094953.3038012-1-anders.roxell@linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin

dmaengine: ti: edma: support sw triggered chans in of_edma_xlate()

2025-03-10T20:56:40Z

The .of_edma_xlate() function always sets the hw_triggered flag to true. This causes sw triggered channels consumed via the device-tree to not function properly, as the driver incorrectly assumes they are hw triggered. Modify the xlate() function to correctly set the hw_triggered flag to false for channels reserved for memcpy operation (ie, sw triggered). Signed-off-by: Matthew Majewski Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20250216214741.207538-1-mattwmajewski@gmail.com Signed-off-by: Vinod Koul

dmaengine: Use str_enable_disable-like helpers

2025-02-10T14:27:11Z

Replace ternary (condition ? "enable" : "disable") syntax with helpers from string_choices.h because: 1. Simple function call with one argument is easier to read. Ternary operator has three arguments and with wrapping might lead to quite long code. 2. Is slightly shorter thus also easier to read. 3. It brings uniformity in the text - same string. 4. Allows deduping by the linker, which results in a smaller binary file. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Manivannan Sadhasivam #dw-edma Reviewed-by: Jernej Skrabec Link: https://lore.kernel.org/r/20250114191021.854080-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul

dmaengine: ti: edma: fix OF node reference leaks in edma_driver

2024-12-24T09:53:32Z

The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but does not release the obtained OF nodes. Thus add a of_node_put() call. This bug was found by an experimental verification tool that I am developing. Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") Signed-off-by: Joe Hattori Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Vinod Koul

dmaengine: ti: edma: make the loop condition simpler in edma_probe()

2024-12-24T09:53:32Z

When i == ecc->num_tc, the edma_probe() calls of_parse_phandle_with_fixed_args() and breaks from the loop regardless of the return value. Since neither the returned value nor the output argument tc_args is used, set i < ecc->num_tc as the loop condition. Signed-off-by: Joe Hattori Link: https://lore.kernel.org/r/20241219020507.1983124-2-joe@pf.is.s.u-tokyo.ac.jp Signed-off-by: Vinod Koul

dmaengine: Switch back to struct platform_driver::remove()

2024-10-14T18:20:34Z

After commit 0edb555a65d1 ("platform: Make platform_driver::remove() return void") .remove() is (again) the right callback to implement for platform drivers. Convert all platform drivers below drivers/dma after the previous conversion commits apart from the wireless drivers to use .remove(), with the eventual goal to drop struct platform_driver::remove_new(). As .remove() and .remove_new() have the same prototypes, conversion is done by just changing the structure member name in the driver initializer. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20241004062227.187726-2-u.kleine-koenig@baylibre.com Signed-off-by: Vinod Koul

dmaengine: ti: edma: Add some null pointer checks to the edma_probe

2024-01-22T11:23:45Z

devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn Signed-off-by: Vinod Koul

dmaengine: ti: edma: handle irq_of_parse_and_map() errors

2023-10-02T15:58:33Z

Zero is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0. Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/") Signed-off-by: Dan Carpenter Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/f15cb6a7-8449-4f79-98b6-34072f04edbc@moroto.mountain Signed-off-by: Vinod Koul

dmaengine: ti: edma: Annotate struct edma_desc with __counted_by

2023-09-28T11:12:15Z

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct edma_desc. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Vinod Koul Cc: Peter Ujfalusi Cc: dmaengine@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/20230817235859.49846-17-keescook@chromium.org Signed-off-by: Vinod Koul

dmaengine: ti: edma: Convert to platform remove callback returning void

2023-09-28T07:40:57Z

The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230919133207.1400430-52-u.kleine-koenig@pengutronix.de Signed-off-by: Vinod Koul