PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release

[ Upstream commit 85afa9ea122dd9d4a2ead104a951d318975dcd25 ]

The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be
NULL even after EPF initialization. Then it is prudent to check that
they have non-NULL values before releasing the channels. Add the checks
in pci_epf_test_clean_dma_chan().

Without the checks, NULL pointer dereferences happen and they can lead
to a kernel panic in some cases:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
  Call trace:
   dma_release_channel+0x2c/0x120 (P)
   pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test]
   pci_epc_deinit_notify+0x74/0xc0
   tegra_pcie_ep_pex_rst_irq+0x250/0x5d8
   irq_thread_fn+0x34/0xb8
   irq_thread+0x18c/0x2e8
   kthread+0x14c/0x210
   ret_from_fork+0x10/0x20

Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
Fixes: 5ebf3fc59bd2 ("PCI: endpoint: functions/pci-epf-test: Add DMA support to transfer data")
Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
[mani: trimmed the stack trace]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20250916025756.34807-1-shinichiro.kawasaki@wdc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 4ebc49f1a467cb4c78227f992f1ec2b8764d50e7..3fe2187cdd0ba967ad232eafac23a0897a64196e 100644 (file)
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -282,15 +282,20 @@ static void pci_epf_test_clean_dma_chan(struct pci_epf_test *epf_test)
        if (!epf_test->dma_supported)
                return;
 
-       dma_release_channel(epf_test->dma_chan_tx);
-       if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) {
+       if (epf_test->dma_chan_tx) {
+               dma_release_channel(epf_test->dma_chan_tx);
+               if (epf_test->dma_chan_tx == epf_test->dma_chan_rx) {
+                       epf_test->dma_chan_tx = NULL;
+                       epf_test->dma_chan_rx = NULL;
+                       return;
+               }
                epf_test->dma_chan_tx = NULL;
-               epf_test->dma_chan_rx = NULL;
-               return;
        }
 
-       dma_release_channel(epf_test->dma_chan_rx);
-       epf_test->dma_chan_rx = NULL;
+       if (epf_test->dma_chan_rx) {
+               dma_release_channel(epf_test->dma_chan_rx);
+               epf_test->dma_chan_rx = NULL;
+       }
 }
 
 static void pci_epf_test_print_rate(const char *ops, u64 size,