This is a note to let you know that I've just added the patch titled dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: dmaengine-ti-k3-udma-set-bchan-to-null-if-a-channel-request-fail.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 5c6c6d60e4b489308ae4da8424c869f7cc53cd12 Mon Sep 17 00:00:00 2001 From: Kishon Vijay Abraham I <kishon@xxxxxx> Date: Sun, 31 Oct 2021 08:54:10 +0530 Subject: dmaengine: ti: k3-udma: Set bchan to NULL if a channel request fail From: Kishon Vijay Abraham I <kishon@xxxxxx> commit 5c6c6d60e4b489308ae4da8424c869f7cc53cd12 upstream. bcdma_get_*() checks if bchan is already allocated by checking if it has a NON NULL value. For the error cases, bchan will have error value and bcdma_get_*() considers this as already allocated (PASS) since the error values are NON NULL. This results in NULL pointer dereference error while de-referencing bchan. Reset the value of bchan to NULL if a channel request fails. CC: stable@xxxxxxxxxxxxxxx Acked-by: Peter Ujfalusi <peter.ujfalusi@xxxxxxxxx> Signed-off-by: Kishon Vijay Abraham I <kishon@xxxxxx> Link: https://lore.kernel.org/r/20211031032411.27235-2-kishon@xxxxxx Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/dma/ti/k3-udma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -1348,6 +1348,7 @@ static int bcdma_get_bchan(struct udma_c { struct udma_dev *ud = uc->ud; enum udma_tp_level tpl; + int ret; if (uc->bchan) { dev_dbg(ud->dev, "chan%d: already have bchan%d allocated\n", @@ -1365,8 +1366,11 @@ static int bcdma_get_bchan(struct udma_c tpl = ud->bchan_tpl.levels - 1; uc->bchan = __udma_reserve_bchan(ud, tpl, -1); - if (IS_ERR(uc->bchan)) - return PTR_ERR(uc->bchan); + if (IS_ERR(uc->bchan)) { + ret = PTR_ERR(uc->bchan); + uc->bchan = NULL; + return ret; + } uc->tchan = uc->bchan; Patches currently in stable-queue which might be from kishon@xxxxxx are queue-5.15/dmaengine-ti-k3-udma-set-bchan-to-null-if-a-channel-request-fail.patch queue-5.15/arm64-dts-ti-k3-j721e-main-fix-max-virtual-functions.patch queue-5.15/dmaengine-ti-k3-udma-set-r-tchan-or-rflow-to-null-if-request-fail.patch queue-5.15/arm64-dts-ti-j7200-main-fix-bus-range-upto-256-bus-n.patch queue-5.15/arm64-dts-ti-j7200-main-fix-vendor-id-device-id-prop.patch queue-5.15/arm64-dts-ti-k3-j721e-main-fix-bus-range-upto-256-bu.patch