Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755104AbdLGNFV (ORCPT ); Thu, 7 Dec 2017 08:05:21 -0500 Received: from mx08-00178001.pphosted.com ([91.207.212.93]:17713 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755001AbdLGNEN (ORCPT ); Thu, 7 Dec 2017 08:04:13 -0500 Subject: Re: [PATCH 4.9 038/109] dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status To: Greg Kroah-Hartman , CC: , Mboumba Cedric Madianga , Vinod Koul , Sasha Levin References: <20171207125634.631485452@linuxfoundation.org> <20171207125639.023959004@linuxfoundation.org> From: Ludovic BARRE Message-ID: <70aa5af6-8511-1d64-e71e-ff6dde8572cb@st.com> Date: Thu, 7 Dec 2017 14:04:03 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <20171207125639.023959004@linuxfoundation.org> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [10.75.127.48] X-ClientProxiedBy: SFHDAG8NODE3.st.com (10.75.127.24) To SFHDAG6NODE1.st.com (10.75.127.16) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-12-07_04:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2031 Lines: 60 add Pierre-yves Mordret acked-by: Ludovic BARRE On 12/07/2017 01:56 PM, Greg Kroah-Hartman wrote: > 4.9-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: M'boumba Cedric Madianga > > > [ Upstream commit 57b5a32135c813f2ab669039fb4ec16b30cb3305 ] > > chan->desc is always set to NULL when a DMA transfer is complete. > As a DMA transfer could be complete during the call of stm32_dma_tx_status, > we need to be sure that chan->desc is not NULL before using this variable > to avoid a null pointer deference issue. > > Signed-off-by: M'boumba Cedric Madianga > Reviewed-by: Ludovic BARRE > Signed-off-by: Vinod Koul > Signed-off-by: Sasha Levin > Signed-off-by: Greg Kroah-Hartman > --- > drivers/dma/stm32-dma.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > --- a/drivers/dma/stm32-dma.c > +++ b/drivers/dma/stm32-dma.c > @@ -884,7 +884,7 @@ static enum dma_status stm32_dma_tx_stat > struct virt_dma_desc *vdesc; > enum dma_status status; > unsigned long flags; > - u32 residue; > + u32 residue = 0; > > status = dma_cookie_status(c, cookie, state); > if ((status == DMA_COMPLETE) || (!state)) > @@ -892,16 +892,12 @@ static enum dma_status stm32_dma_tx_stat > > spin_lock_irqsave(&chan->vchan.lock, flags); > vdesc = vchan_find_desc(&chan->vchan, cookie); > - if (cookie == chan->desc->vdesc.tx.cookie) { > + if (chan->desc && cookie == chan->desc->vdesc.tx.cookie) > residue = stm32_dma_desc_residue(chan, chan->desc, > chan->next_sg); > - } else if (vdesc) { > + else if (vdesc) > residue = stm32_dma_desc_residue(chan, > to_stm32_dma_desc(vdesc), 0); > - } else { > - residue = 0; > - } > - > dma_set_residue(state, residue); > > spin_unlock_irqrestore(&chan->vchan.lock, flags); > >