From mboxrd@z Thu Jan 1 00:00:00 1970 From: Simon Horman Date: Fri, 30 Jan 2015 13:38:28 +0000 Subject: Re: [PATCH] usb: renesas_usbhs: fix NULL pointer dereference in dma_release_channel() Message-Id: <20150130133828.GD31922@verge.net.au> List-Id: References: <1422601103-1144-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> In-Reply-To: <1422601103-1144-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-sh@vger.kernel.org On Fri, Jan 30, 2015 at 03:58:23PM +0900, Yoshihiro Shimoda wrote: > This patch fixes an issue that the following commit causes NULL > pointer dereference in dma_release_channel(). > "usb: renesas_usbhs: add support for requesting DT DMA" > (commit id abd2dbf6bb1b5f3a03a8c76b1a8879da1dd30caa) > > The usbhsf_dma_init_dt() should set fifo->{t,r}x_chan to NULL if > dma_request_slave_channel_reason() returns IS_ERR value. > Otherwise, usbhsf_dma_quit() will call dma_release_channel(), and then > NULL pointer dereference happens. > > Reported-by: Simon Horman > Signed-off-by: Yoshihiro Shimoda I have tested this on the lager and koelsch boards using shmobile_defconfig and next-20150129 as a base. The environment where I originally observed the problem. Tested-by: Simon Horman > --- > This patch is based on Felipe's usb.git / testing/next branch. > (commit id }b3990cb707ff91cd6507d53a0a730afe97) > > drivers/usb/renesas_usbhs/fifo.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c > index 4c086b1..d891bff 100644 > --- a/drivers/usb/renesas_usbhs/fifo.c > +++ b/drivers/usb/renesas_usbhs/fifo.c > @@ -1072,7 +1072,11 @@ static void usbhsf_dma_init_pdev(struct usbhs_fifo *fifo) > static void usbhsf_dma_init_dt(struct device *dev, struct usbhs_fifo *fifo) > { > fifo->tx_chan = dma_request_slave_channel_reason(dev, "tx"); > + if (IS_ERR(fifo->tx_chan)) > + fifo->tx_chan = NULL; > fifo->rx_chan = dma_request_slave_channel_reason(dev, "rx"); > + if (IS_ERR(fifo->rx_chan)) > + fifo->rx_chan = NULL; > } > > static void usbhsf_dma_init(struct usbhs_priv *priv, > -- > 1.7.9.5 >