Re: [PATCH 1/1] dmaengine: pl330: Check if the DMA descriptor is NULL

[Lars-Peter Clausen <lars@metafoo.de>]

On 07/19/2014 03:21 AM, Javier Martinez Canillas wrote:
> Commit 6079d38 ("dmaengine: pl330: Remove useless xfer_cb indirection")
> removed the __callback() function which created an unnecessary level of
> indirection to execute the tranfer callback .xfer_cb
>
> Unfortunately the commit also changed the semantics slightly since that
> function used to check if the request was not NULL before attempting to
> execute the callback function. Not checking this could lead to a kernel
> NULL pointer dereference error.

This should not happen, but I guess it can happen when terminal_all() is 
called. (It's wrong to try to complete a descriptor from terminal_all() in 
the first place, but that's a different issue)

>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>

Acked-by: Lars-Peter Clausen <lars@metafoo.de>

> ---
>   drivers/dma/pl330.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
> index bc5878a..a55d754 100644
> --- a/drivers/dma/pl330.c
> +++ b/drivers/dma/pl330.c
> @@ -1441,9 +1441,14 @@ xfer_exit:
>
>   static void dma_pl330_rqcb(struct dma_pl330_desc *desc, enum pl330_op_err err)
>   {
> -	struct dma_pl330_chan *pch = desc->pchan;
> +	struct dma_pl330_chan *pch;
>   	unsigned long flags;
>
> +	if (!desc)
> +		return;
> +
> +	pch = desc->pchan;
> +
>   	/* If desc aborted */
>   	if (!pch)
>   		return;
>