From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 783E1C43613 for ; Mon, 24 Jun 2019 10:18:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 406752146E for ; Mon, 24 Jun 2019 10:18:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561371526; bh=iX2Cvxv91ZoHMIbqMcsmuPSIR3ZlwV71LpYzXjuL+B0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wqjl5e8gMIZsGa8ntRJFvmNzYXc4qb41xY1RCZBMf1ewSqnY6YS9/l4DDrGankxB5 R33lVZlmWTi6zZLqsuh8NxDClGL1V/8TIyktjZxTTX/xLKXkspZROxNyMUSIV7hUNk tOMaxTUGsj5LqjjQkb4cVXADiD+WwoIEllC9Np/s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730091AbfFXKPx (ORCPT ); Mon, 24 Jun 2019 06:15:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:53298 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730025AbfFXKPw (ORCPT ); Mon, 24 Jun 2019 06:15:52 -0400 Received: from localhost (f4.8f.5177.ip4.static.sl-reverse.com [119.81.143.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1172B20645; Mon, 24 Jun 2019 10:15:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561371352; bh=iX2Cvxv91ZoHMIbqMcsmuPSIR3ZlwV71LpYzXjuL+B0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jCA7SiNPp/vsvvBstvbj3qe4Fkfk89um9DEKxedDdTfTAMf31SGNnOZg/wB69s7FS pfP+CrHW5/lpH25bsduFNU99HasiKU0he7Um2YRRGqZ66J80PF9iKqtdjbvHhT3AUo ailpaR7q4x6bkO2zqFhxxJ2JsplSb2sa1J0+Zkos= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baolin Wang , Vinod Koul , Sasha Levin Subject: [PATCH 5.1 036/121] dmaengine: sprd: Fix the possible crash when getting descriptor status Date: Mon, 24 Jun 2019 17:56:08 +0800 Message-Id: <20190624092322.661887903@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190624092320.652599624@linuxfoundation.org> References: <20190624092320.652599624@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org [ Upstream commit 16d0f85e45b99411ac10cb12cdd9279204a72381 ] We will get a NULL virtual descriptor by vchan_find_desc() when the descriptor has been submitted, that will crash the kernel when getting the descriptor status. In this case, since the descriptor has been submitted to process, but it is not completed now, which means the descriptor is listed into the 'vc->desc_submitted' list now. So we can not get current processing descriptor by vchan_find_desc(), but the pointer 'schan->cur_desc' will point to the current processing descriptor, then we can use 'schan->cur_desc' to get current processing descriptor's status to avoid this issue. Signed-off-by: Baolin Wang Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin --- drivers/dma/sprd-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c index 48431e2da987..e29342ab85f6 100644 --- a/drivers/dma/sprd-dma.c +++ b/drivers/dma/sprd-dma.c @@ -625,7 +625,7 @@ static enum dma_status sprd_dma_tx_status(struct dma_chan *chan, else pos = 0; } else if (schan->cur_desc && schan->cur_desc->vd.tx.cookie == cookie) { - struct sprd_dma_desc *sdesc = to_sprd_dma_desc(vd); + struct sprd_dma_desc *sdesc = schan->cur_desc; if (sdesc->dir == DMA_DEV_TO_MEM) pos = sprd_dma_get_dst_addr(schan); -- 2.20.1