Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine fixes from Vinod Koul:
- Intel idxd fixes for idxd_free() handling, refcount underflow on
module unload, double free in idxd_setup_wqs()
- Qualcomm bam dma missing properties and handing for channels with ees
- dw device reference leak in rzn1_dmamux_route_allocate()
* tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
dmaengine: idxd: Fix double free in idxd_setup_wqs()
dmaengine: idxd: Fix refcount underflow on module unload
dmaengine: idxd: Remove improper idxd_free
dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
dt-bindings: dma: qcom: bam-dma: Add missing required properties
+44
-26
+4
Documentation/devicetree/bindings/dma/qcom,bam-dma.yaml
+4
Documentation/devicetree/bindings/dma/qcom,bam-dma.yaml
+11
-4
drivers/dma/dw/rzn1-dmamux.c
+11
-4
drivers/dma/dw/rzn1-dmamux.c
···
48
48
u32 mask;
49
49
int ret;
50
50
51
-
if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS)
52
-
return ERR_PTR(-EINVAL);
51
+
if (dma_spec->args_count != RNZ1_DMAMUX_NCELLS) {
52
+
ret = -EINVAL;
53
+
goto put_device;
54
+
}
53
55
54
56
map = kzalloc(sizeof(*map), GFP_KERNEL);
55
-
if (!map)
56
-
return ERR_PTR(-ENOMEM);
57
+
if (!map) {
58
+
ret = -ENOMEM;
59
+
goto put_device;
60
+
}
57
61
58
62
chan = dma_spec->args[0];
59
63
map->req_idx = dma_spec->args[4];
···
98
94
if (ret)
99
95
goto clear_bitmap;
100
96
97
+
put_device(&pdev->dev);
101
98
return map;
102
99
103
100
clear_bitmap:
104
101
clear_bit(map->req_idx, dmamux->used_chans);
105
102
free_map:
106
103
kfree(map);
104
+
put_device:
105
+
put_device(&pdev->dev);
107
106
108
107
return ERR_PTR(ret);
109
108
}
+21
-18
drivers/dma/idxd/init.c
+21
-18
drivers/dma/idxd/init.c
···
189
189
idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev));
190
190
if (!idxd->wq_enable_map) {
191
191
rc = -ENOMEM;
192
-
goto err_bitmap;
192
+
goto err_free_wqs;
193
193
}
194
194
195
195
for (i = 0; i < idxd->max_wqs; i++) {
196
196
wq = kzalloc_node(sizeof(*wq), GFP_KERNEL, dev_to_node(dev));
197
197
if (!wq) {
198
198
rc = -ENOMEM;
199
-
goto err;
199
+
goto err_unwind;
200
200
}
201
201
202
202
idxd_dev_set_type(&wq->idxd_dev, IDXD_DEV_WQ);
203
203
conf_dev = wq_confdev(wq);
204
204
wq->id = i;
205
205
wq->idxd = idxd;
206
-
device_initialize(wq_confdev(wq));
206
+
device_initialize(conf_dev);
207
207
conf_dev->parent = idxd_confdev(idxd);
208
208
conf_dev->bus = &dsa_bus_type;
209
209
conf_dev->type = &idxd_wq_device_type;
210
210
rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id);
211
-
if (rc < 0)
212
-
goto err;
211
+
if (rc < 0) {
212
+
put_device(conf_dev);
213
+
kfree(wq);
214
+
goto err_unwind;
215
+
}
213
216
214
217
mutex_init(&wq->wq_lock);
215
218
init_waitqueue_head(&wq->err_queue);
···
223
220
wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;
224
221
wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev));
225
222
if (!wq->wqcfg) {
223
+
put_device(conf_dev);
224
+
kfree(wq);
226
225
rc = -ENOMEM;
227
-
goto err;
226
+
goto err_unwind;
228
227
}
229
228
230
229
if (idxd->hw.wq_cap.op_config) {
231
230
wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL);
232
231
if (!wq->opcap_bmap) {
232
+
kfree(wq->wqcfg);
233
+
put_device(conf_dev);
234
+
kfree(wq);
233
235
rc = -ENOMEM;
234
-
goto err_opcap_bmap;
236
+
goto err_unwind;
235
237
}
236
238
bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS);
237
239
}
···
247
239
248
240
return 0;
249
241
250
-
err_opcap_bmap:
251
-
kfree(wq->wqcfg);
252
-
253
-
err:
254
-
put_device(conf_dev);
255
-
kfree(wq);
256
-
242
+
err_unwind:
257
243
while (--i >= 0) {
258
244
wq = idxd->wqs[i];
259
245
if (idxd->hw.wq_cap.op_config)
···
256
254
conf_dev = wq_confdev(wq);
257
255
put_device(conf_dev);
258
256
kfree(wq);
259
-
260
257
}
261
258
bitmap_free(idxd->wq_enable_map);
262
259
263
-
err_bitmap:
260
+
err_free_wqs:
264
261
kfree(idxd->wqs);
265
262
266
263
return rc;
···
1292
1291
device_unregister(idxd_confdev(idxd));
1293
1292
idxd_shutdown(pdev);
1294
1293
idxd_device_remove_debugfs(idxd);
1295
-
idxd_cleanup(idxd);
1294
+
perfmon_pmu_remove(idxd);
1295
+
idxd_cleanup_interrupts(idxd);
1296
+
if (device_pasid_enabled(idxd))
1297
+
idxd_disable_system_pasid(idxd);
1296
1298
pci_iounmap(pdev, idxd->reg_base);
1297
1299
put_device(idxd_confdev(idxd));
1298
-
idxd_free(idxd);
1299
1300
pci_disable_device(pdev);
1300
1301
}
1301
1302
+6
-2
drivers/dma/qcom/bam_dma.c
+6
-2
drivers/dma/qcom/bam_dma.c
···
1283
1283
if (!bdev->bamclk) {
1284
1284
ret = of_property_read_u32(pdev->dev.of_node, "num-channels",
1285
1285
&bdev->num_channels);
1286
-
if (ret)
1286
+
if (ret) {
1287
1287
dev_err(bdev->dev, "num-channels unspecified in dt\n");
1288
+
return ret;
1289
+
}
1288
1290
1289
1291
ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees",
1290
1292
&bdev->num_ees);
1291
-
if (ret)
1293
+
if (ret) {
1292
1294
dev_err(bdev->dev, "num-ees unspecified in dt\n");
1295
+
return ret;
1296
+
}
1293
1297
}
1294
1298
1295
1299
ret = clk_prepare_enable(bdev->bamclk);
+2
-2
drivers/dma/ti/edma.c
+2
-2
drivers/dma/ti/edma.c
···
2064
2064
* priority. So Q0 is the highest priority queue and the last queue has
2065
2065
* the lowest priority.
2066
2066
*/
2067
-
queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1, sizeof(s8),
2068
-
GFP_KERNEL);
2067
+
queue_priority_map = devm_kcalloc(dev, ecc->num_tc + 1,
2068
+
sizeof(*queue_priority_map), GFP_KERNEL);
2069
2069
if (!queue_priority_map)
2070
2070
return -ENOMEM;
2071
2071