From patchwork Tue Mar 5 15:58:22 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Porter X-Patchwork-Id: 2220301 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by patchwork1.kernel.org (Postfix) with ESMTP id 5B6373FCF6 for ; Tue, 5 Mar 2013 16:00:47 +0000 (UTC) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UCuFr-0002g0-Gj; Tue, 05 Mar 2013 15:58:15 +0000 Received: from mail-ie0-x22a.google.com ([2607:f8b0:4001:c03::22a]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UCuFo-0002fb-WB for linux-arm-kernel@lists.infradead.org; Tue, 05 Mar 2013 15:58:13 +0000 Received: by mail-ie0-f170.google.com with SMTP id c11so8010196ieb.15 for ; Tue, 05 Mar 2013 07:58:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:sender:from:to:cc:subject:date:message-id:x-mailer; bh=z6IUa3eHQhGQL3A6C3p054bWpS+RfyIwMWRiQDSBuvw=; b=0z+ZyrWX5ZDq4RdsmcpIosPmQYx0nxg5LH+iIQBmDho6G6BHt6IDezHjV2Kgr8qyIl ez0zu/RUjmxfLInEwOKi5AOXDqySXdaVBNPvFkl3qJQhy3m0zRkQxNba34Z8wnjDpdLe +XUeqYFjGxL1n9pzi3p3wMekTfk6bU5JxWnkPYZci8vVoAl2FPVosrKNfdy57OS5bXu4 T+IZuhFJWvySz8XcEUGWWqvbVnn7IJjbrRY6eG4AwswkAAnt/Ml4xHDs/fceIBMqDEo1 KMb6Pg32uZh1KpNWzv2jxyTbalxowdPvswEMkXgIiLTjNcn/ghTxRuUqQaCPl4bs0fm+ ECrA== X-Received: by 10.50.237.71 with SMTP id va7mr6681420igc.88.1362499091733; Tue, 05 Mar 2013 07:58:11 -0800 (PST) Received: from beef.ohporter.com (cpe-98-27-254-98.neo.res.rr.com. [98.27.254.98]) by mx.google.com with ESMTPS id uq1sm16210770igc.5.2013.03.05.07.58.10 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 05 Mar 2013 07:58:11 -0800 (PST) From: Matt Porter To: Sekhar Nori Subject: [PATCH v2] arm: davinci: fix edma dmaengine induced null pointer dereference on da830 Date: Tue, 5 Mar 2013 10:58:22 -0500 Message-Id: <1362499102-16468-1-git-send-email-mporter@ti.com> X-Mailer: git-send-email 1.7.9.5 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130305_105813_062284_82CCC724 X-CRM114-Status: GOOD ( 11.63 ) X-Spam-Score: -1.9 (-) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-1.9 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (ohiomdp[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: Linux DaVinci Kernel List , Tomas Novotny , Linux ARM Kernel List X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org This adds additional error checking to the private edma api implementation to catch the case where the edma_alloc_slot() has an invalid controller parameter. The edma dmaengine wrapper driver relies on this condition being handled in order to avoid setting up a second edma dmaengine instance on DA830. Verfied using a DA850 with the second EDMA controller platform instance removed to simulate a DA830 which only has a single EDMA controller. Reported-by: Tomas Novotny Signed-off-by: Matt Porter Cc: stable@vger.kernel.org # v3.7.x+ Tested-by: Tomas Novotny --- v2: Move error check out of conditional to catch all cases arch/arm/mach-davinci/dma.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm/mach-davinci/dma.c b/arch/arm/mach-davinci/dma.c index a685e97..45b7c71 100644 --- a/arch/arm/mach-davinci/dma.c +++ b/arch/arm/mach-davinci/dma.c @@ -743,6 +743,9 @@ EXPORT_SYMBOL(edma_free_channel); */ int edma_alloc_slot(unsigned ctlr, int slot) { + if (!edma_cc[ctlr]) + return -EINVAL; + if (slot >= 0) slot = EDMA_CHAN_SLOT(slot);