Re: [PATCH] dmaengine: dma-jz4780: Fix NULL dereference in tx_status after terminate

[Frank Li <Frank.li@oss.nxp.com>]

On Fri, Oct 23, 2026 at 10:09:53AM +0200, Olivier Louvignes wrote:
> [You don't often get email from olivier@mgcrea.io. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> jz4780_dma_terminate_all() sets jzchan->desc to NULL. The cookie of a
> cyclic transfer never completes, so a later jz4780_dma_tx_status() call
> with that cookie finds no descriptor on the channel's lists, takes the
> else branch and reads jzchan->desc->vdesc.tx.cookie through the NULL
> pointer.
>
> The driver has always allowed this, but it only shows once something
> calls tx_status() on a terminated cyclic channel, as
> snd_dmaengine_pcm_sync_stop() does since commit 88e98af9f4b5 ("ALSA:
> pcm_dmaengine: Don't synchronize DMA channel when DMA is paused").
> Closing a playback stream then oopses:
>
>   epc : jz4780_dma_tx_status+0x184/0x210
>   Call Trace:
>   [<8048e104>] jz4780_dma_tx_status+0x184/0x210
>   [<805804d8>] snd_dmaengine_pcm_sync_stop+0x4c/0x94
>   [<8058f068>] snd_soc_pcm_component_sync_stop+0x80/0xc0
>   [<805775b8>] do_hw_free+0x20/0x6c
>   [<80577650>] snd_pcm_release_substream+0x4c/0x9c
>   [<805781ac>] snd_pcm_release+0x48/0x9c
>
> Only compare the cookie with the current descriptor's when there is one.
>
> Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller")
> Cc: stable@vger.kernel.org
> Signed-off-by: Olivier Louvignes <olivier@mgcrea.io>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> Apologies to the stable list: two copies of this patch reached it earlier
> today from test sends, with the Cc trailer still in place. Please ignore
> those. This is the real submission, and it is the same patch.

Please bump version when send this one.

Frank

>
> Seen on an Ingenic X1600 (HiBy R1, compatible "ingenic,x1830-dma" as
> fallback) on v7.3; the code is shared by all the SoCs this driver
> supports. The patch is build-tested on 734bef548a96 (v7.3-7363).
>
>  drivers/dma/dma-jz4780.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
> index 6070dfdb7114..7f827be502f1 100644
> --- a/drivers/dma/dma-jz4780.c
> +++ b/drivers/dma/dma-jz4780.c
> @@ -658,7 +658,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
>                 /* On the issued list, so hasn't been processed yet */
>                 residue = jz4780_dma_desc_residue(jzchan,
>                                         to_jz4780_dma_desc(vdesc), 0);
> -       } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
> +       } else if (jzchan->desc && cookie == jzchan->desc->vdesc.tx.cookie) {
>                 residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
>                                         jzchan->curr_hwdesc + 1);
>         }
>
> base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
> --
> 2.39.5
>