[PATCH] dma-debug: Avoid uninitialized hash traversal in mapping dumps

[PATCH] dma-debug: Avoid uninitialized hash traversal in mapping dumps

[Avi Weiss]

Booting with dma_debug=off causes dma_debug_init() to return before
initializing the hash buckets. The debugfs dump file is registered
independently, so reading it traverses an uninitialized list and
triggers a NULL pointer dereference in dump_show(). The
debug_dma_dump_mappings() helper has the same unchecked traversal.

Skip both dump paths until dma_debug_initialized is set. Check the
initialization state rather than global_disable so that mappings
recorded before DMA debugging disables itself at runtime remain
available.

With CONFIG_DMA_API_DEBUG=y and CONFIG_DEBUG_FS=y, reading the dump
with dma_debug=off triggers an oops in the unpatched kernel. The
patched kernel returns an empty dump, while dumping with DMA debugging
enabled still returns mapping information.

Fixes: 173735c346c4 ("dma-debug: fix debugfs initialization order")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 kernel/dma/debug.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index 36c1f7cbb2ae..2f487246d8ce 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -543,6 +543,9 @@ void debug_dma_dump_mappings(struct device *dev)
 	int idx;
 	phys_addr_t cln;
 
+	if (!dma_debug_initialized)
+		return;
+
 	for (idx = 0; idx < HASH_SIZE; idx++) {
 		struct hash_bucket *bucket = &dma_entry_hash[idx];
 		struct dma_debug_entry *entry;
@@ -576,6 +579,9 @@ static int dump_show(struct seq_file *seq, void *v)
 	int idx;
 	phys_addr_t cln;
 
+	if (!dma_debug_initialized)
+		return 0;
+
 	for (idx = 0; idx < HASH_SIZE; idx++) {
 		struct hash_bucket *bucket = &dma_entry_hash[idx];
 		struct dma_debug_entry *entry;

base-commit: 97d73c8251226cf27cc6656b4c542869bb8c69fa
-- 
2.43.0