From: garsilva@embeddedor.com (Gustavo A. R. Silva)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
Date: Mon, 20 Nov 2017 08:28:14 -0600 [thread overview]
Message-ID: <20171120142814.GA3315@embeddedor.com> (raw)
_xt_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference.
Fix this by moving the pointer dereference after _xt_ has been null
checked.
This issue was detected with the help of Coccinelle.
Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/dma/at_hdmac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index fbab271..a861b5b 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
unsigned long flags)
{
struct at_dma_chan *atchan = to_at_dma_chan(chan);
- struct data_chunk *first = xt->sgl;
+ struct data_chunk *first;
struct at_desc *desc = NULL;
size_t xfer_count;
unsigned int dwidth;
@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
return NULL;
+ first = xt->sgl;
+
dev_info(chan2dev(chan),
"%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
__func__, &xt->src_start, &xt->dst_start, xt->numf,
--
2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
To: Ludovic Desroches <ludovic.desroches@microchip.com>,
Vinod Koul <vinod.koul@intel.com>,
Dan Williams <dan.j.williams@intel.com>
Cc: linux-arm-kernel@lists.infradead.org, dmaengine@vger.kernel.org,
linux-kernel@vger.kernel.org,
"Gustavo A. R. Silva" <garsilva@embeddedor.com>
Subject: [PATCH] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
Date: Mon, 20 Nov 2017 08:28:14 -0600 [thread overview]
Message-ID: <20171120142814.GA3315@embeddedor.com> (raw)
_xt_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference.
Fix this by moving the pointer dereference after _xt_ has been null
checked.
This issue was detected with the help of Coccinelle.
Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/dma/at_hdmac.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index fbab271..a861b5b 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
unsigned long flags)
{
struct at_dma_chan *atchan = to_at_dma_chan(chan);
- struct data_chunk *first = xt->sgl;
+ struct data_chunk *first;
struct at_desc *desc = NULL;
size_t xfer_count;
unsigned int dwidth;
@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
return NULL;
+ first = xt->sgl;
+
dev_info(chan2dev(chan),
"%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
__func__, &xt->src_start, &xt->dst_start, xt->numf,
--
2.7.4
next reply other threads:[~2017-11-20 14:28 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-20 14:28 Gustavo A. R. Silva [this message]
2017-11-20 14:28 ` [PATCH] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved Gustavo A. R. Silva
2017-11-23 10:11 ` Ludovic Desroches
2017-11-23 10:11 ` Ludovic Desroches
2017-11-29 14:19 ` Vinod Koul
2017-11-29 14:19 ` Vinod Koul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171120142814.GA3315@embeddedor.com \
--to=garsilva@embeddedor.com \
--cc=linux-arm-kernel@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.