Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932459AbdLGNTF (ORCPT ); Thu, 7 Dec 2017 08:19:05 -0500 Received: from mx07-00178001.pphosted.com ([62.209.51.94]:40703 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932478AbdLGNTA (ORCPT ); Thu, 7 Dec 2017 08:19:00 -0500 Subject: Re: [PATCH 4.9 038/109] dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status From: Ludovic BARRE To: Greg Kroah-Hartman , CC: , Mboumba Cedric Madianga , Vinod Koul , Sasha Levin , Pierre Yves MORDRET References: <20171207125634.631485452@linuxfoundation.org> <20171207125639.023959004@linuxfoundation.org> <70aa5af6-8511-1d64-e71e-ff6dde8572cb@st.com> Message-ID: Date: Thu, 7 Dec 2017 14:18:51 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <70aa5af6-8511-1d64-e71e-ff6dde8572cb@st.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [10.75.127.50] X-ClientProxiedBy: SFHDAG7NODE2.st.com (10.75.127.20) To SFHDAG6NODE1.st.com (10.75.127.16) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-12-07_05:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2417 Lines: 62 with Pierre Yves mail it's better ;-) On 12/07/2017 02:04 PM, Ludovic BARRE wrote: > add Pierre-yves Mordret > > acked-by: Ludovic BARRE > > On 12/07/2017 01:56 PM, Greg Kroah-Hartman wrote: >> 4.9-stable review patch.  If anyone has any objections, please let me >> know. >> >> ------------------ >> >> From: M'boumba Cedric Madianga >> >> >> [ Upstream commit 57b5a32135c813f2ab669039fb4ec16b30cb3305 ] >> >> chan->desc is always set to NULL when a DMA transfer is complete. >> As a DMA transfer could be complete during the call of >> stm32_dma_tx_status, >> we need to be sure that chan->desc is not NULL before using this variable >> to avoid a null pointer deference issue. >> >> Signed-off-by: M'boumba Cedric Madianga >> Reviewed-by: Ludovic BARRE >> Signed-off-by: Vinod Koul >> Signed-off-by: Sasha Levin >> Signed-off-by: Greg Kroah-Hartman >> --- >>   drivers/dma/stm32-dma.c |   10 +++------- >>   1 file changed, 3 insertions(+), 7 deletions(-) >> >> --- a/drivers/dma/stm32-dma.c >> +++ b/drivers/dma/stm32-dma.c >> @@ -884,7 +884,7 @@ static enum dma_status stm32_dma_tx_stat >>       struct virt_dma_desc *vdesc; >>       enum dma_status status; >>       unsigned long flags; >> -    u32 residue; >> +    u32 residue = 0; >>       status = dma_cookie_status(c, cookie, state); >>       if ((status == DMA_COMPLETE) || (!state)) >> @@ -892,16 +892,12 @@ static enum dma_status stm32_dma_tx_stat >>       spin_lock_irqsave(&chan->vchan.lock, flags); >>       vdesc = vchan_find_desc(&chan->vchan, cookie); >> -    if (cookie == chan->desc->vdesc.tx.cookie) { >> +    if (chan->desc && cookie == chan->desc->vdesc.tx.cookie) >>           residue = stm32_dma_desc_residue(chan, chan->desc, >>                            chan->next_sg); >> -    } else if (vdesc) { >> +    else if (vdesc) >>           residue = stm32_dma_desc_residue(chan, >>                            to_stm32_dma_desc(vdesc), 0); >> -    } else { >> -        residue = 0; >> -    } >> - >>       dma_set_residue(state, residue); >>       spin_unlock_irqrestore(&chan->vchan.lock, flags); >> >>