qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

dma: contiguous: Check return value of dma_contiguous_reserve_area()

Browse Source 
JIRA: https://redhat.atlassian.net/browse/RHEL-180328

commit c33efdfcfa6f80e05ce1ee33694c1bad4994cd78
Author: Shanker Donthineni <sdonthineni@nvidia.com>
Date:   Thu Jan 29 12:13:17 2026 -0600

    dma: contiguous: Check return value of dma_contiguous_reserve_area()

    Commit 8f1fc1bf1a3d ("dma: contiguous: Reserve default CMA heap")
    introduced a bug where dma_heap_cma_register_heap() is called with
    a NULL pointer when dma_contiguous_reserve_area() fails to reserve
    the CMA area.

    When dma_contiguous_reserve_area() fails, dma_contiguous_default_area
    remains NULL (initialized as a global variable), but the code doesn't
    check the return value and proceeds to call dma_heap_cma_register_heap()
    with this NULL pointer.

    Later during boot, add_cma_heaps() iterates through the dma_areas[]
    array and attempts to register heaps. When it encounters the NULL
    pointer stored by the earlier call, it crashes in __add_cma_heap()
    -> dma_heap_add() when trying to dereference the NULL CMA pointer.

    The crash manifests as:
      Unable to handle kernel NULL pointer dereference at virtual address
      0000000000000038
      ...
      Call trace:
       dma_heap_add+0x40/0x2b0
       __add_cma_heap+0x80/0xe0
       add_cma_heaps+0x64/0xb0
       do_one_initcall+0x60/0x318
       kernel_init_freeable+0x260/0x2f0
       kernel_init+0x2c/0x168
       ret_from_fork+0x10/0x20

    Fix this by checking the return value of dma_contiguous_reserve_area()
    and only calling dma_heap_cma_register_heap() when the reservation
    succeeds.

    Fixes: 8f1fc1bf1a3d ("dma: contiguous: Reserve default CMA heap")
    Signed-off-by: Shanker Donthineni <sdonthineni@nvidia.com>
    Reviewed-by: T.J. Mercier <tjmercier@google.com>
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Link: https://lore.kernel.org/r/20260129181317.2429196-1-sdonthineni@nvidia.com

Signed-off-by: Karol Herbst <kherbst@redhat.com>
This commit is contained in:
Karol Herbst
2026-08-18 11:01:58 +02:00
parent da1035ed86
commit 06f5d8dd11
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/dma/contiguous.c
+6 -4
View File
@@ -252,10 +252,12 @@ void __init dma_contiguous_reserve(phys_addr_t limit)
pr_debug("%s: reserving %ld MiB for global area\n", __func__,
(unsigned long)selected_size / SZ_1M);
dma_contiguous_reserve_area(selected_size, selected_base,
selected_limit,
&dma_contiguous_default_area,
fixed);
ret = dma_contiguous_reserve_area(selected_size, selected_base,
selected_limit,
&dma_contiguous_default_area,
fixed);
if (ret)
return;
ret = dma_heap_cma_register_heap(dma_contiguous_default_area);
if (ret)