Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756056AbbLGLAy (ORCPT ); Mon, 7 Dec 2015 06:00:54 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:33917 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755394AbbLGLAw (ORCPT ); Mon, 7 Dec 2015 06:00:52 -0500 From: "M'boumba Cedric Madianga" To: vinod.koul@intel.com, dan.j.williams@intel.com, mcoquelin.stm32@gmail.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: "M'boumba Cedric Madianga" Subject: [PATCH v2] dmaengine: stm32-dma: Fix unchecked deference of chan->desc Date: Mon, 7 Dec 2015 12:00:28 +0100 Message-Id: <1449486028-29344-1-git-send-email-cedric.madianga@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1761 Lines: 52 'commit d8b468394fb7 ("dmaengine: Add STM32 DMA driver")' leads to the following Smatch complaint: drivers/dma/stm32-dma.c:562 stm32_dma_issue_pending() error: we previously assumed 'chan->desc' could be null (see line 560) So, this patch fixes the unchecked dereference of chan->desc by returning operation not permitted error when stm32_dma_start_transfer() does not succeed to allocate a virtual channel descriptor. Reported-by: Dan Carpenter Signed-off-by: M'boumba Cedric Madianga --- Changes since v1: Explain what the patch fixes in the title (Vinod) Add Dan as reporter using Reported-by tag (Vinod) --- --- drivers/dma/stm32-dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c index 12f3a3e..047476a 100644 --- a/drivers/dma/stm32-dma.c +++ b/drivers/dma/stm32-dma.c @@ -437,7 +437,7 @@ static int stm32_dma_start_transfer(struct stm32_dma_chan *chan) if (!chan->desc) { vdesc = vchan_next_desc(&chan->vchan); if (!vdesc) - return 0; + return -EPERM; chan->desc = to_stm32_dma_desc(vdesc); chan->next_sg = 0; @@ -559,7 +559,7 @@ static void stm32_dma_issue_pending(struct dma_chan *c) if (!chan->busy) { if (vchan_issue_pending(&chan->vchan) && !chan->desc) { ret = stm32_dma_start_transfer(chan); - if ((chan->desc->cyclic) && (!ret)) + if ((!ret) && (chan->desc->cyclic)) stm32_dma_configure_next_sg(chan); } } -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/