[PATCH] dmaengine: dma-jz4780: Fix NULL dereference in tx_status after terminate

[PATCH] dmaengine: dma-jz4780: Fix NULL dereference in tx_status after terminate

[Olivier Louvignes]

jz4780_dma_terminate_all() sets jzchan->desc to NULL. The cookie of a
cyclic transfer never completes, so a later jz4780_dma_tx_status() call
with that cookie finds no descriptor on the channel's lists, takes the
else branch and reads jzchan->desc->vdesc.tx.cookie through the NULL
pointer.

The driver has always allowed this, but it only shows once something
calls tx_status() on a terminated cyclic channel, as
snd_dmaengine_pcm_sync_stop() does since commit 88e98af9f4b5 ("ALSA:
pcm_dmaengine: Don't synchronize DMA channel when DMA is paused").
Closing a playback stream then oopses:

  epc : jz4780_dma_tx_status+0x184/0x210
  Call Trace:
  [<8048e104>] jz4780_dma_tx_status+0x184/0x210
  [<805804d8>] snd_dmaengine_pcm_sync_stop+0x4c/0x94
  [<8058f068>] snd_soc_pcm_component_sync_stop+0x80/0xc0
  [<805775b8>] do_hw_free+0x20/0x6c
  [<80577650>] snd_pcm_release_substream+0x4c/0x9c
  [<805781ac>] snd_pcm_release+0x48/0x9c

Only compare the cookie with the current descriptor's when there is one.

Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
Cc: stable@vger.kernel.org
Signed-off-by: Olivier Louvignes <olivier@mgcrea.io>
---
Apologies to the stable list: two copies of this patch reached it earlier
today from test sends, with the Cc trailer still in place. Please ignore
those. This is the real submission, and it is the same patch.

Seen on an Ingenic X1600 (HiBy R1, compatible "ingenic,x1830-dma" as
fallback) on v7.3; the code is shared by all the SoCs this driver
supports. The patch is build-tested on 734bef548a96 (v7.3-7363).

 drivers/dma/dma-jz4780.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
index 6070dfdb7114..7f827be502f1 100644
--- a/drivers/dma/dma-jz4780.c
+++ b/drivers/dma/dma-jz4780.c
@@ -658,7 +658,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
 		/* On the issued list, so hasn't been processed yet */
 		residue = jz4780_dma_desc_residue(jzchan,
 					to_jz4780_dma_desc(vdesc), 0);
-	} else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+	} else if (jzchan->desc && cookie == jzchan->desc->vdesc.tx.cookie) {
 		residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
 					jzchan->curr_hwdesc + 1);
 	}

base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
-- 
2.39.5

Re: [PATCH] dmaengine: dma-jz4780: Fix NULL dereference in tx_status after terminate

[Paul Cercueil]

Hi Olivier, Vinod,

Le vendredi 23 octobre 2026 à 10:09 +0200, Olivier Louvignes a écrit :
> jz4780_dma_terminate_all() sets jzchan->desc to NULL. The cookie of a
> cyclic transfer never completes, so a later jz4780_dma_tx_status()
> call
> with that cookie finds no descriptor on the channel's lists, takes
> the
> else branch and reads jzchan->desc->vdesc.tx.cookie through the NULL
> pointer.
> 
> The driver has always allowed this, but it only shows once something
> calls tx_status() on a terminated cyclic channel, as
> snd_dmaengine_pcm_sync_stop() does since commit 88e98af9f4b5 ("ALSA:
> pcm_dmaengine: Don't synchronize DMA channel when DMA is paused").
> Closing a playback stream then oopses:
> 
>   epc : jz4780_dma_tx_status+0x184/0x210
>   Call Trace:
>   [<8048e104>] jz4780_dma_tx_status+0x184/0x210
>   [<805804d8>] snd_dmaengine_pcm_sync_stop+0x4c/0x94
>   [<8058f068>] snd_soc_pcm_component_sync_stop+0x80/0xc0
>   [<805775b8>] do_hw_free+0x20/0x6c
>   [<80577650>] snd_pcm_release_substream+0x4c/0x9c
>   [<805781ac>] snd_pcm_release+0x48/0x9c
> 
> Only compare the cookie with the current descriptor's when there is
> one.
> 
> Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic
> JZ4780 DMA controller")
> Cc: stable@vger.kernel.org
> Signed-off-by: Olivier Louvignes <olivier@mgcrea.io>

Reviewed-by: Paul Cercueil <paul@crapouillou.net>

Cheers,
-Paul

> ---
> Apologies to the stable list: two copies of this patch reached it
> earlier
> today from test sends, with the Cc trailer still in place. Please
> ignore
> those. This is the real submission, and it is the same patch.
> 
> Seen on an Ingenic X1600 (HiBy R1, compatible "ingenic,x1830-dma" as
> fallback) on v7.3; the code is shared by all the SoCs this driver
> supports. The patch is build-tested on 734bef548a96 (v7.3-7363).
> 
>  drivers/dma/dma-jz4780.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
> index 6070dfdb7114..7f827be502f1 100644
> --- a/drivers/dma/dma-jz4780.c
> +++ b/drivers/dma/dma-jz4780.c
> @@ -658,7 +658,7 @@ static enum dma_status
> jz4780_dma_tx_status(struct dma_chan *chan,
>  		/* On the issued list, so hasn't been processed yet
> */
>  		residue = jz4780_dma_desc_residue(jzchan,
>  					to_jz4780_dma_desc(vdesc),
> 0);
> -	} else if (cookie == jzchan->desc->vdesc.tx.cookie) {
> +	} else if (jzchan->desc && cookie == jzchan->desc-
> >vdesc.tx.cookie) {
>  		residue = jz4780_dma_desc_residue(jzchan, jzchan-
> >desc,
>  					jzchan->curr_hwdesc + 1);
>  	}
> 
> base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b

Re: [PATCH] dmaengine: dma-jz4780: Fix NULL dereference in tx_status after terminate

[Frank Li]

On Fri, Oct 23, 2026 at 10:09:53AM +0200, Olivier Louvignes wrote:
> [You don't often get email from olivier@mgcrea.io. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> jz4780_dma_terminate_all() sets jzchan->desc to NULL. The cookie of a
> cyclic transfer never completes, so a later jz4780_dma_tx_status() call
> with that cookie finds no descriptor on the channel's lists, takes the
> else branch and reads jzchan->desc->vdesc.tx.cookie through the NULL
> pointer.
>
> The driver has always allowed this, but it only shows once something
> calls tx_status() on a terminated cyclic channel, as
> snd_dmaengine_pcm_sync_stop() does since commit 88e98af9f4b5 ("ALSA:
> pcm_dmaengine: Don't synchronize DMA channel when DMA is paused").
> Closing a playback stream then oopses:
>
>   epc : jz4780_dma_tx_status+0x184/0x210
>   Call Trace:
>   [<8048e104>] jz4780_dma_tx_status+0x184/0x210
>   [<805804d8>] snd_dmaengine_pcm_sync_stop+0x4c/0x94
>   [<8058f068>] snd_soc_pcm_component_sync_stop+0x80/0xc0
>   [<805775b8>] do_hw_free+0x20/0x6c
>   [<80577650>] snd_pcm_release_substream+0x4c/0x9c
>   [<805781ac>] snd_pcm_release+0x48/0x9c
>
> Only compare the cookie with the current descriptor's when there is one.
>
> Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
> Cc: stable@vger.kernel.org
> Signed-off-by: Olivier Louvignes <olivier@mgcrea.io>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> Apologies to the stable list: two copies of this patch reached it earlier
> today from test sends, with the Cc trailer still in place. Please ignore
> those. This is the real submission, and it is the same patch.

Please bump version when send this one.

Frank

>
> Seen on an Ingenic X1600 (HiBy R1, compatible "ingenic,x1830-dma" as
> fallback) on v7.3; the code is shared by all the SoCs this driver
> supports. The patch is build-tested on 734bef548a96 (v7.3-7363).
>
>  drivers/dma/dma-jz4780.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
> index 6070dfdb7114..7f827be502f1 100644
> --- a/drivers/dma/dma-jz4780.c
> +++ b/drivers/dma/dma-jz4780.c
> @@ -658,7 +658,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
>                 /* On the issued list, so hasn't been processed yet */
>                 residue = jz4780_dma_desc_residue(jzchan,
>                                         to_jz4780_dma_desc(vdesc), 0);
> -       } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
> +       } else if (jzchan->desc && cookie == jzchan->desc->vdesc.tx.cookie) {
>                 residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
>                                         jzchan->curr_hwdesc + 1);
>         }
>
> base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
> --
> 2.39.5
>