dmaengine: rcar-dmac: initialize all data before registering IRQ handler

Anton Volkov noticed that engine->dev is NULL before
of_dma_controller_register() in probe.
Thus there might be a NULL pointer dereference in
rcar_dmac_chan_start_xfer while accessing chan->chan.device->dev which
is equal to (&dmac->engine)->dev.
On same reason, same and similar things will happen if we didn't
initialize all necessary data before calling register irq function.
To be more safety code, this patch initialize all necessary data
before calling register irq function.

Reported-by: Anton Volkov <avolkov@ispras.ru>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>

diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index ffcadca53243d9ef55ea7949a3cef1730b69b7c1..2b2c7db3e48043fcdb1d0ed377613dde185f0a1b 100644 (file)
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1690,6 +1690,15 @@ static int rcar_dmac_chan_probe(struct rcar_dmac *dmac,
        if (!irqname)
                return -ENOMEM;
 
+       /*
+        * Initialize the DMA engine channel and add it to the DMA engine
+        * channels list.
+        */
+       chan->device = &dmac->engine;
+       dma_cookie_init(chan);
+
+       list_add_tail(&chan->device_node, &dmac->engine.channels);
+
        ret = devm_request_threaded_irq(dmac->dev, rchan->irq,
                                        rcar_dmac_isr_channel,
                                        rcar_dmac_isr_channel_thread, 0,
@@ -1700,15 +1709,6 @@ static int rcar_dmac_chan_probe(struct rcar_dmac *dmac,
                return ret;
        }
 
-       /*
-        * Initialize the DMA engine channel and add it to the DMA engine
-        * channels list.
-        */
-       chan->device = &dmac->engine;
-       dma_cookie_init(chan);
-
-       list_add_tail(&chan->device_node, &dmac->engine.channels);
-
        return 0;
 }
 
@@ -1794,14 +1794,6 @@ static int rcar_dmac_probe(struct platform_device *pdev)
        if (!irqname)
                return -ENOMEM;
 
-       ret = devm_request_irq(&pdev->dev, irq, rcar_dmac_isr_error, 0,
-                              irqname, dmac);
-       if (ret) {
-               dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",
-                       irq, ret);
-               return ret;
-       }
-
        /* Enable runtime PM and initialize the device. */
        pm_runtime_enable(&pdev->dev);
        ret = pm_runtime_get_sync(&pdev->dev);
@@ -1818,8 +1810,32 @@ static int rcar_dmac_probe(struct platform_device *pdev)
                goto error;
        }
 
-       /* Initialize the channels. */
-       INIT_LIST_HEAD(&dmac->engine.channels);
+       /* Initialize engine */
+       engine = &dmac->engine;
+
+       dma_cap_set(DMA_MEMCPY, engine->cap_mask);
+       dma_cap_set(DMA_SLAVE, engine->cap_mask);
+
+       engine->dev             = &pdev->dev;
+       engine->copy_align      = ilog2(RCAR_DMAC_MEMCPY_XFER_SIZE);
+
+       engine->src_addr_widths = widths;
+       engine->dst_addr_widths = widths;
+       engine->directions      = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM);
+       engine->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
+
+       engine->device_alloc_chan_resources     = rcar_dmac_alloc_chan_resources;
+       engine->device_free_chan_resources      = rcar_dmac_free_chan_resources;
+       engine->device_prep_dma_memcpy          = rcar_dmac_prep_dma_memcpy;
+       engine->device_prep_slave_sg            = rcar_dmac_prep_slave_sg;
+       engine->device_prep_dma_cyclic          = rcar_dmac_prep_dma_cyclic;
+       engine->device_config                   = rcar_dmac_device_config;
+       engine->device_terminate_all            = rcar_dmac_chan_terminate_all;
+       engine->device_tx_status                = rcar_dmac_tx_status;
+       engine->device_issue_pending            = rcar_dmac_issue_pending;
+       engine->device_synchronize              = rcar_dmac_device_synchronize;
+
+       INIT_LIST_HEAD(&engine->channels);
 
        for (i = 0; i < dmac->n_channels; ++i) {
                ret = rcar_dmac_chan_probe(dmac, &dmac->channels[i],
@@ -1828,6 +1844,14 @@ static int rcar_dmac_probe(struct platform_device *pdev)
                        goto error;
        }
 
+       ret = devm_request_irq(&pdev->dev, irq, rcar_dmac_isr_error, 0,
+                              irqname, dmac);
+       if (ret) {
+               dev_err(&pdev->dev, "failed to request IRQ %u (%d)\n",
+                       irq, ret);
+               return ret;
+       }
+
        /* Register the DMAC as a DMA provider for DT. */
        ret = of_dma_controller_register(pdev->dev.of_node, rcar_dmac_of_xlate,
                                         NULL);
@@ -1839,29 +1863,6 @@ static int rcar_dmac_probe(struct platform_device *pdev)
         *
         * Default transfer size of 32 bytes requires 32-byte alignment.
         */
-       engine = &dmac->engine;
-       dma_cap_set(DMA_MEMCPY, engine->cap_mask);
-       dma_cap_set(DMA_SLAVE, engine->cap_mask);
-
-       engine->dev = &pdev->dev;
-       engine->copy_align = ilog2(RCAR_DMAC_MEMCPY_XFER_SIZE);
-
-       engine->src_addr_widths = widths;
-       engine->dst_addr_widths = widths;
-       engine->directions = BIT(DMA_MEM_TO_DEV) | BIT(DMA_DEV_TO_MEM);
-       engine->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
-
-       engine->device_alloc_chan_resources = rcar_dmac_alloc_chan_resources;
-       engine->device_free_chan_resources = rcar_dmac_free_chan_resources;
-       engine->device_prep_dma_memcpy = rcar_dmac_prep_dma_memcpy;
-       engine->device_prep_slave_sg = rcar_dmac_prep_slave_sg;
-       engine->device_prep_dma_cyclic = rcar_dmac_prep_dma_cyclic;
-       engine->device_config = rcar_dmac_device_config;
-       engine->device_terminate_all = rcar_dmac_chan_terminate_all;
-       engine->device_tx_status = rcar_dmac_tx_status;
-       engine->device_issue_pending = rcar_dmac_issue_pending;
-       engine->device_synchronize = rcar_dmac_device_synchronize;
-
        ret = dma_async_device_register(engine);
        if (ret < 0)
                goto error;