[PATCH 1/2] lib/genalloc: don't dereference a NULL pool in gen_pool_dma_[z]alloc()

From: Amit Patole

Date: Fri Nov 06 2026 - 09:08:21 EST


gen_pool_dma_alloc() returned NULL for a NULL pool since it was added.
Commit cf394fc5f715 ("lib/genalloc.c: Add algorithm, align and zeroed
family of DMA allocators") moved that check into
gen_pool_dma_alloc_algo(), but gen_pool_dma_alloc() now reads
pool->algo and pool->data before calling it, so a NULL pool is
dereferenced instead. gen_pool_dma_zalloc(), added by the same commit,
has the same problem. The _algo() and _align() variants still return
NULL.

All in-tree callers check the pool before calling, so this is not
known to be reachable today, but the four entry points disagree and
the original behaviour is easy to restore. Check for a NULL pool before
dereferencing it.

Found by a KUnit test for lib/genalloc.c, which crashed in
gen_pool_dma_alloc(NULL, ...) on UML. An AI coding assistant (Claude
Opus 5.5) was used to write that test and this change; with it the
test passes.

Fixes: cf394fc5f715 ("lib/genalloc.c: Add algorithm, align and zeroed family of DMA allocators")
Signed-off-by: Amit Patole <amit.patole@xxxxxxxxx>
---
lib/genalloc.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/lib/genalloc.c b/lib/genalloc.c
index 841f29783833..40ca25cd87c8 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -340,6 +340,9 @@ EXPORT_SYMBOL(gen_pool_alloc_algo_owner);
*/
void *gen_pool_dma_alloc(struct gen_pool *pool, size_t size, dma_addr_t *dma)
{
+ if (!pool)
+ return NULL;
+
return gen_pool_dma_alloc_algo(pool, size, dma, pool->algo, pool->data);
}
EXPORT_SYMBOL(gen_pool_dma_alloc);
@@ -418,6 +421,9 @@ EXPORT_SYMBOL(gen_pool_dma_alloc_align);
*/
void *gen_pool_dma_zalloc(struct gen_pool *pool, size_t size, dma_addr_t *dma)
{
+ if (!pool)
+ return NULL;
+
return gen_pool_dma_zalloc_algo(pool, size, dma, pool->algo, pool->data);
}
EXPORT_SYMBOL(gen_pool_dma_zalloc);

--
2.43.5