linux.git/drivers/firewire/ohci.c, branch v7.2

firewire: ohci: fix NULL pointer dereference in ar_context_release

2026-08-13T12:02:23+00:00

During the error handling path of the driver's probe function, a NULL
pointer dereference can occur in ar_context_release().

When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping
fails), the devres cleanup mechanism invokes release_ohci(). This function
unconditionally calls ar_context_release() to clean up the asynchronous
receive contexts. However, if ar_context_init() was not yet called,
ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by
devres_alloc()).

ar_context_release() immediately dereferences ctx->ohci to get the dev
pointer before checking if the context was actually initialized, leading to
a crash:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543
Call Trace:
 release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567
 release_nodes drivers/base/devres.c:546 [inline]
 devres_release_all+0x1a8/0x260 drivers/base/devres.c:576
 device_unbind_cleanup drivers/base/dd.c:597 [inline]
 really_probe+0x451/0xae0 drivers/base/dd.c:772

To fix this, move the assignment of the dev pointer after the !ctx->buffer
check. If ctx->buffer is NULL, it indicates that the context was never
successfully initialized and there is nothing to release, safely avoiding
the dereference of the uninitialized ctx->ohci pointer.

Fixes: 5716e58aecdd ("firewire: ohci: release buffer for AR req/resp contexts when managed resource is released")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+d30aad27833a559defab@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d30aad27833a559defab
Link: https://syzkaller.appspot.com/ai_job?id=10a18617-7893-42dd-bf1c-cd49e19e95d9
Signed-off-by: Aleksandr Nogikh 
Link: https://lore.kernel.org/r/90c5db71-dd1f-4d46-b9d3-2f1046cbd5ea@mail.kernel.org
Signed-off-by: Takashi Sakamoto

firewire: ohci: initialize page array to use alloc_pages_bulk() correctly

2026-02-28T18:09:24+00:00

The call of alloc_pages_bulk() skips to fill entries of page array when
the entries already have values. While, 1394 OHCI PCI driver passes the
page array without initializing. It could cause invalid state at PFN
validation in vmap().

Fixes: f2ae92780ab9 ("firewire: ohci: split page allocation from dma mapping")
Reported-by: John Ogness 
Reported-and-tested-by: Harald Arnesen 
Reported-and-tested-by: David Gow 
Closes: https://lore.kernel.org/lkml/87tsv1vig5.fsf@jogness.linutronix.de/
Signed-off-by: Takashi Sakamoto 
Signed-off-by: Linus Torvalds

firewire: core: provide isoc header buffer size outside card driver

2026-01-18T08:18:48+00:00

For single-channel isochronous contexts, the header storage size is
hard-coded to PAGE_SIZE. which is inconvenient for protocol
implementations requiring more space.

This commit refactors the code to obtain the header storage size outside
the 1394 OHCI driver.

Link: https://lore.kernel.org/r/20260117142823.440811-8-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: allocate isoc context header by kvmalloc()

2026-01-18T08:18:48+00:00

Isochronous packet handling now runs in a workqueue context, where page
faults is acceptable.

This commit replaces __get_free_page() with kvmalloc() when allocating the
isochronous context header buffer.

Link: https://lore.kernel.org/r/20260117142823.440811-7-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: core: add flags member for isochronous context structure

2026-01-18T08:18:48+00:00

This is minor code refactoring to add a flag member to the isochronous
context structure. At present, it is used only for the option to drop
packets when the context header overflows.

Link: https://lore.kernel.org/r/20260117142823.440811-6-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: use cleanup helper for isoc context header allocation

2026-01-18T08:18:48+00:00

Some cleanup helpers are useful in error path after memory allocation for
header storage.

Link: https://lore.kernel.org/r/20260117142823.440811-5-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: code refactoring to use union for isoc multiple channel state

2026-01-18T08:18:48+00:00

In 1394 OHCI driver, some members of struct iso_context are only used for
multi-channel isochronous contexts.

This commit uses a union for these members to clearly separate
multi-channel specific state.

Link: https://lore.kernel.org/r/20260117142823.440811-4-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: refactor isoc single-channel state using a union

2026-01-18T08:18:48+00:00

In 1394 OHCI driver, some members of struct iso_context are only used for
single-channel isochronous contexts.

This commit groups these members into a union.

Link: https://lore.kernel.org/r/20260117142823.440811-3-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: fix index of pages for dma address to 1394 OHCI IT context

2026-01-15T12:33:36+00:00

The index of pages for dma address was changed wrongly. This commit
corrents it.

Fixes: ef6bdffbb88d ("firewire: core: stop using page private to store DMA mapping address")
Link: https://lore.kernel.org/r/20260114131729.16133-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto

firewire: ohci: stop using page private to store DMA mapping address

2026-01-12T02:49:38+00:00

There is a long discussion about the use of private field in page
structure between Linux kernel developers.

This commit stop using page private to store DMA mapping address for
AR context, to prepare for mm future change.

Link: https://lore.kernel.org/r/20260110013911.19160-9-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto