dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail

commit 5c6c6d60e4b489308ae4da8424c869f7cc53cd12 upstream.

bcdma_get_*() checks if bchan is already allocated by checking if it
has a NON NULL value. For the error cases, bchan will have error value
and bcdma_get_*() considers this as already allocated (PASS) since the
error values are NON NULL. This results in NULL pointer dereference
error while de-referencing bchan.

Reset the value of bchan to NULL if a channel request fails.

CC: stable@vger.kernel.org
Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Link: https://lore.kernel.org/r/20211031032411.27235-2-kishon@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
index a358586..14ae288 100644 (file)
--- a/drivers/dma/ti/k3-udma.c
+++ b/drivers/dma/ti/k3-udma.c
@@ -1348,6 +1348,7 @@ static int bcdma_get_bchan(struct udma_chan *uc)
 {
        struct udma_dev *ud = uc->ud;
        enum udma_tp_level tpl;
+       int ret;
 
        if (uc->bchan) {
                dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n",
@@ -1365,8 +1366,11 @@ static int bcdma_get_bchan(struct udma_chan *uc)
                tpl = ud->bchan_tpl.levels - 1;
 
        uc->bchan = __udma_reserve_bchan(ud, tpl, -1);
-       if (IS_ERR(uc->bchan))
-               return PTR_ERR(uc->bchan);
+       if (IS_ERR(uc->bchan)) {
+               ret = PTR_ERR(uc->bchan);
+               uc->bchan = NULL;
+               return ret;
+       }
 
        uc->tchan = uc->bchan;