git: 25a61a7927c8 - main - ufshci: check SDB queue allocations for failure

The branch main has been updated by jaeyoon:

URL: https://cgit.FreeBSD.org/src/commit/?id=25a61a7927c8b1a516e6e095a6f53031a8636fde

commit 25a61a7927c8b1a516e6e095a6f53031a8636fde
Author:     Jaeyoon Choi <[email protected]>
AuthorDate: 2026-08-10 01:43:34 +0000
Commit:     Jaeyoon Choi <[email protected]>
CommitDate: 2026-08-10 02:28:50 +0000

    ufshci: check SDB queue allocations for failure
    
    The hardware queue and ucd_bus_addr allocations use M_NOWAIT but were
    used without a NULL check, and the payload bus_dmamap_create() return
    value was ignored, so a failed allocation was only discovered by
    faulting on it later. Fail the construction instead. The teardown
    path handles the partially constructed queue.
    
    Sponsored by:           Samsung Electronics
    Reviewed by:            imp (mentor)
    Differential Revision:  https://reviews.freebsd.org/D58661
---
 sys/dev/ufshci/ufshci_req_sdb.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c
index c7bf033ddc37..9f3a2a866ae0 100644
--- a/sys/dev/ufshci/ufshci_req_sdb.c
+++ b/sys/dev/ufshci/ufshci_req_sdb.c
@@ -86,6 +86,8 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue,
 	req_queue->hwq->ucd_bus_addr = malloc(sizeof(bus_addr_t) *
 		req_queue->num_trackers,
 	    M_UFSHCI, M_ZERO | M_NOWAIT);
+	if (req_queue->hwq->ucd_bus_addr == NULL)
+		return (ENOMEM);
 
 	/*
 	 * Each component must be page aligned, and individual PRP lists
@@ -141,8 +143,13 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue,
 	}
 
 	for (i = 0; i < req_queue->num_trackers; i++) {
-		bus_dmamap_create(req_queue->dma_tag_payload, 0,
+		error = bus_dmamap_create(req_queue->dma_tag_payload, 0,
 		    &hwq->act_tr[i]->payload_dma_map);
+		if (error != 0) {
+			ufshci_printf(ctrlr,
+			    "request payload map create failed %d\n", error);
+			goto out;
+		}
 
 		hwq->act_tr[i]->ucd = (struct ufshci_utp_cmd_desc *)ucdmem;
 		hwq->act_tr[i]->ucd_bus_addr = hwq->ucd_bus_addr[i];
@@ -181,6 +188,8 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr,
 	/* Single Doorbell mode uses only one queue. (UFSHCI_SDB_Q = 0) */
 	req_queue->hwq = malloc(sizeof(struct ufshci_hw_queue), M_UFSHCI,
 	    M_ZERO | M_NOWAIT);
+	if (req_queue->hwq == NULL)
+		return (ENOMEM);
 	hwq = &req_queue->hwq[UFSHCI_SDB_Q];
 	hwq->num_entries = req_queue->num_entries;
 	hwq->num_trackers = req_queue->num_trackers;