[PATCH v5 18/18] dmaengine: ti: k3-udma: Validate resource ID and fix logging in reservation
Sai Sree Kartheek Adivi
s-adivi at ti.com
Wed Feb 18 01:52:43 PST 2026
The `__udma_reserve_##res` macro currently lacks a bounds check for
the provided `id`. If a caller passes an ID exceeding the resource
count (`ud->res##_cnt`), `test_bit()` performs an out-of-bounds
memory access on the bitmap.
Additionally, the macro returns `-ENOENT` when a resource is already
in use, which is semantically incorrect. The logging logic is also
broken, printing the literal "res##<id>" instead of the resource
name.
Update the macro to:
1. Validate `id` against `ud->res##_cnt` and return `-EINVAL` if out
of bounds.
2. Return `-EBUSY` instead of `-ENOENT` when a resource is already
reserved, correctly reflecting the resource state.
3. Use the stringification operator `#res` to correctly print the
resource name (e.g., "tchan") in error messages.
Signed-off-by: Sai Sree Kartheek Adivi <s-adivi at ti.com>
---
drivers/dma/ti/k3-udma-common.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/ti/k3-udma-common.c b/drivers/dma/ti/k3-udma-common.c
index 711a35b278762..dac8773d73bf9 100644
--- a/drivers/dma/ti/k3-udma-common.c
+++ b/drivers/dma/ti/k3-udma-common.c
@@ -2010,9 +2010,14 @@ struct udma_##res *__udma_reserve_##res(struct udma_dev *ud, \
int id) \
{ \
if (id >= 0) { \
+ if (id >= ud->res##_cnt) { \
+ dev_err(ud->dev, \
+ #res " id %d is out of bounds.\n", id); \
+ return ERR_PTR(-EINVAL); \
+ } \
if (test_bit(id, ud->res##_map)) { \
- dev_err(ud->dev, "res##%d is in use\n", id); \
- return ERR_PTR(-ENOENT); \
+ dev_err(ud->dev, #res "%d is in use\n", id); \
+ return ERR_PTR(-EBUSY); \
} \
} else { \
int start; \
--
2.34.1
More information about the linux-arm-kernel
mailing list