remoteproc: fix a potential NULL-dereference on cleanup

commit 7168d914a782086e217214c57ddfc7cc4b738c0c upstream.

We only need to allocate mapping if there is an IOMMU domain.

Otherwise, when the mappings are released, the assumption that
an IOMMU domain is there will crash and burn.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[ohad: revise commit log]
Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index d5c2dbfc7443c0ca4ced101fc0ab5447b0bf1e8f..70b296f4c7f4142f5117b1b57171854b4c8fe7de 100644 (file)
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -545,17 +545,10 @@ static int rproc_handle_carveout(struct rproc *rproc,
        dev_dbg(dev, "carveout rsc: da %x, pa %x, len %x, flags %x\n",
                        rsc->da, rsc->pa, rsc->len, rsc->flags);
 
-       mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
-       if (!mapping) {
-               dev_err(dev, "kzalloc mapping failed\n");
-               return -ENOMEM;
-       }
-
        carveout = kzalloc(sizeof(*carveout), GFP_KERNEL);
        if (!carveout) {
                dev_err(dev, "kzalloc carveout failed\n");
-               ret = -ENOMEM;
-               goto free_mapping;
+               return -ENOMEM;
        }
 
        va = dma_alloc_coherent(dev->parent, rsc->len, &dma, GFP_KERNEL);
@@ -585,11 +578,18 @@ static int rproc_handle_carveout(struct rproc *rproc,
         * physical address in this case.
         */
        if (rproc->domain) {
+               mapping = kzalloc(sizeof(*mapping), GFP_KERNEL);
+               if (!mapping) {
+                       dev_err(dev, "kzalloc mapping failed\n");
+                       ret = -ENOMEM;
+                       goto dma_free;
+               }
+
                ret = iommu_map(rproc->domain, rsc->da, dma, rsc->len,
                                                                rsc->flags);
                if (ret) {
                        dev_err(dev, "iommu_map failed: %d\n", ret);
-                       goto dma_free;
+                       goto free_mapping;
                }
 
                /*
@@ -634,12 +634,12 @@ static int rproc_handle_carveout(struct rproc *rproc,
 
        return 0;
 
+free_mapping:
+       kfree(mapping);
 dma_free:
        dma_free_coherent(dev->parent, rsc->len, va, dma);
 free_carv:
        kfree(carveout);
-free_mapping:
-       kfree(mapping);
        return ret;
 }