dmaengine: k3dma: KASAN null-ptr-deref in k3_dma_int_handler() on early IRQ

[Jaeyoung Chung]

Hi,

k3_dma_probe() in drivers/dma/k3dma.c registers the interrupt handler
with devm_request_irq() before it initializes d->phy. If an interrupt
arrives before d->phy is initialized, k3_dma_int_handler() dereferences
a NULL d->phy, causing a kernel panic.

The probe path, in k3_dma_probe():

    d = devm_kzalloc(&op->dev, sizeof(*d), GFP_KERNEL); /* d->phy == NULL */
    ...
    ret = devm_request_irq(&op->dev, irq,
                           k3_dma_int_handler, 0, DRIVER_NAME, d); /* register handler */
    ...
    d->phy = devm_kcalloc(&op->dev,
                          d->dma_channels, sizeof(struct k3_dma_phy), GFP_KERNEL); /* initialize d->phy */

The interrupt handler, k3_dma_int_handler(), dereferences d->phy without
check:

    p = &d->phy[i];
    c = p->vchan;   /* NULL pointer dereference */

If the device raises an interrupt before d->phy is initialized, the
handler dereferences the NULL d->phy, triggering a KASAN
null-ptr-deref.

Suggested fix: move the d->phy = devm_kcalloc() assignment above
devm_request_irq(), so the d->phy array is valid before the
handler can run.

Reported-by: Sangyun Kim <sangyun.kim@xxxxxxxxx>
Reported-by: Kyungwook Boo <bookyungwook@xxxxxxxxx>

Thanks,
Jaeyoung Chung