diff options
| author | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 01:43:34 +0000 |
|---|---|---|
| committer | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 02:28:50 +0000 |
| commit | 25a61a7927c8b1a516e6e095a6f53031a8636fde (patch) | |
| tree | aee4e2b48936a16265573e964004c2c1c8b721f7 | |
| parent | 24c2ead33b44ca5db2605b462c935236f3a73443 (diff) | |
ufshci: check SDB queue allocations for failure
The hardware queue and ucd_bus_addr allocations use M_NOWAIT but were
used without a NULL check, and the payload bus_dmamap_create() return
value was ignored, so a failed allocation was only discovered by
faulting on it later. Fail the construction instead. The teardown
path handles the partially constructed queue.
Sponsored by: Samsung Electronics
Reviewed by: imp (mentor)
Differential Revision: https://reviews.freebsd.org/D58661
| -rw-r--r-- | sys/dev/ufshci/ufshci_req_sdb.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c index c7bf033ddc37..9f3a2a866ae0 100644 --- a/sys/dev/ufshci/ufshci_req_sdb.c +++ b/sys/dev/ufshci/ufshci_req_sdb.c @@ -86,6 +86,8 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue, req_queue->hwq->ucd_bus_addr = malloc(sizeof(bus_addr_t) * req_queue->num_trackers, M_UFSHCI, M_ZERO | M_NOWAIT); + if (req_queue->hwq->ucd_bus_addr == NULL) + return (ENOMEM); /* * Each component must be page aligned, and individual PRP lists @@ -141,8 +143,13 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue, } for (i = 0; i < req_queue->num_trackers; i++) { - bus_dmamap_create(req_queue->dma_tag_payload, 0, + error = bus_dmamap_create(req_queue->dma_tag_payload, 0, &hwq->act_tr[i]->payload_dma_map); + if (error != 0) { + ufshci_printf(ctrlr, + "request payload map create failed %d\n", error); + goto out; + } hwq->act_tr[i]->ucd = (struct ufshci_utp_cmd_desc *)ucdmem; hwq->act_tr[i]->ucd_bus_addr = hwq->ucd_bus_addr[i]; @@ -181,6 +188,8 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr, /* Single Doorbell mode uses only one queue. (UFSHCI_SDB_Q = 0) */ req_queue->hwq = malloc(sizeof(struct ufshci_hw_queue), M_UFSHCI, M_ZERO | M_NOWAIT); + if (req_queue->hwq == NULL) + return (ENOMEM); hwq = &req_queue->hwq[UFSHCI_SDB_Q]; hwq->num_entries = req_queue->num_entries; hwq->num_trackers = req_queue->num_trackers; |
