aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJaeyoon Choi <jaeyoon@FreeBSD.org>2026-08-10 01:43:34 +0000
committerJaeyoon Choi <jaeyoon@FreeBSD.org>2026-08-10 02:28:50 +0000
commit25a61a7927c8b1a516e6e095a6f53031a8636fde (patch)
treeaee4e2b48936a16265573e964004c2c1c8b721f7
parent24c2ead33b44ca5db2605b462c935236f3a73443 (diff)
ufshci: check SDB queue allocations for failure
The hardware queue and ucd_bus_addr allocations use M_NOWAIT but were used without a NULL check, and the payload bus_dmamap_create() return value was ignored, so a failed allocation was only discovered by faulting on it later. Fail the construction instead. The teardown path handles the partially constructed queue. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58661
-rw-r--r--sys/dev/ufshci/ufshci_req_sdb.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c
index c7bf033ddc37..9f3a2a866ae0 100644
--- a/sys/dev/ufshci/ufshci_req_sdb.c
+++ b/sys/dev/ufshci/ufshci_req_sdb.c
@@ -86,6 +86,8 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue,
req_queue->hwq->ucd_bus_addr = malloc(sizeof(bus_addr_t) *
req_queue->num_trackers,
M_UFSHCI, M_ZERO | M_NOWAIT);
+ if (req_queue->hwq->ucd_bus_addr == NULL)
+ return (ENOMEM);
/*
* Each component must be page aligned, and individual PRP lists
@@ -141,8 +143,13 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue,
}
for (i = 0; i < req_queue->num_trackers; i++) {
- bus_dmamap_create(req_queue->dma_tag_payload, 0,
+ error = bus_dmamap_create(req_queue->dma_tag_payload, 0,
&hwq->act_tr[i]->payload_dma_map);
+ if (error != 0) {
+ ufshci_printf(ctrlr,
+ "request payload map create failed %d\n", error);
+ goto out;
+ }
hwq->act_tr[i]->ucd = (struct ufshci_utp_cmd_desc *)ucdmem;
hwq->act_tr[i]->ucd_bus_addr = hwq->ucd_bus_addr[i];
@@ -181,6 +188,8 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr,
/* Single Doorbell mode uses only one queue. (UFSHCI_SDB_Q = 0) */
req_queue->hwq = malloc(sizeof(struct ufshci_hw_queue), M_UFSHCI,
M_ZERO | M_NOWAIT);
+ if (req_queue->hwq == NULL)
+ return (ENOMEM);
hwq = &req_queue->hwq[UFSHCI_SDB_Q];
hwq->num_entries = req_queue->num_entries;
hwq->num_trackers = req_queue->num_trackers;