lkml.org 
[lkml]   [2018]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 073/145] dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>


    [ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ]

    _xt_ is being dereferenced before it is null checked, hence there is a
    potential null pointer dereference.

    Fix this by moving the pointer dereference after _xt_ has been null
    checked.

    This issue was detected with the help of Coccinelle.

    Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
    Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
    Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/dma/at_hdmac.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/dma/at_hdmac.c
    +++ b/drivers/dma/at_hdmac.c
    @@ -709,7 +709,7 @@ atc_prep_dma_interleaved(struct dma_chan
    unsigned long flags)
    {
    struct at_dma_chan *atchan = to_at_dma_chan(chan);
    - struct data_chunk *first = xt->sgl;
    + struct data_chunk *first;
    struct at_desc *desc = NULL;
    size_t xfer_count;
    unsigned int dwidth;
    @@ -721,6 +721,8 @@ atc_prep_dma_interleaved(struct dma_chan
    if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
    return NULL;

    + first = xt->sgl;
    +
    dev_info(chan2dev(chan),
    "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
    __func__, &xt->src_start, &xt->dst_start, xt->numf,

    \
     
     \ /
      Last update: 2018-02-23 20:53    [W:4.537 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site