From patchwork Mon Dec 7 11:00:28 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: M'boumba Cedric Madianga X-Patchwork-Id: 7782391 Return-Path: X-Original-To: patchwork-dmaengine@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 69DC0BEEE1 for ; Mon, 7 Dec 2015 11:00:55 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8FC1A203E6 for ; Mon, 7 Dec 2015 11:00:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id ADC68203F1 for ; Mon, 7 Dec 2015 11:00:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755661AbbLGLAx (ORCPT ); Mon, 7 Dec 2015 06:00:53 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:33917 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755394AbbLGLAw (ORCPT ); Mon, 7 Dec 2015 06:00:52 -0500 Received: by wmvv187 with SMTP id v187so160538119wmv.1; Mon, 07 Dec 2015 03:00:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=KrZAsjDsLliJ0x+J4geNIsU1qI4EfwEfPfLezMEYwIM=; b=sCehvvDT+zkqaHJdkT+Fi1S46JmYC7289vIaQKuAKdem21dyXTN2vz6hED4e6Is4Ot FEv5pYKVnxhi4LFsVesXMhSNQ9KLzbM+taFLE8Km10rW4gibhHRfPWH5rOu5jj8jvahI 04SNRz7gF6ZOj7efeTGw4vexXcz3uyL4VqrTbdM8VnfgAqZeErv0S+VxDv8J+bMNIjVy wGJSDJa+fQuHpwa92FDKveEUGlP5bsH/gRn/FA4/m0SJ5uAxHfnloIPT5b4q3S4vRaiO S1+8PCyVk1gJG3TDjY8pSzvtE1kExcasn9tKSxQr98Akdgr1qqm+FKvK3p9quzhR/RZu 8zmA== X-Received: by 10.28.54.165 with SMTP id y37mr21806745wmh.55.1449486051151; Mon, 07 Dec 2015 03:00:51 -0800 (PST) Received: from lmenx29w.st.com. ([80.12.39.60]) by smtp.gmail.com with ESMTPSA id q74sm21122208wmd.0.2015.12.07.03.00.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 07 Dec 2015 03:00:50 -0800 (PST) From: M'boumba Cedric Madianga To: vinod.koul@intel.com, dan.j.williams@intel.com, mcoquelin.stm32@gmail.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: M'boumba Cedric Madianga Subject: [PATCH v2] dmaengine: stm32-dma: Fix unchecked deference of chan->desc Date: Mon, 7 Dec 2015 12:00:28 +0100 Message-Id: <1449486028-29344-1-git-send-email-cedric.madianga@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP 'commit d8b468394fb7 ("dmaengine: Add STM32 DMA driver")' leads to the following Smatch complaint: drivers/dma/stm32-dma.c:562 stm32_dma_issue_pending() error: we previously assumed 'chan->desc' could be null (see line 560) So, this patch fixes the unchecked dereference of chan->desc by returning operation not permitted error when stm32_dma_start_transfer() does not succeed to allocate a virtual channel descriptor. Reported-by: Dan Carpenter Signed-off-by: M'boumba Cedric Madianga --- Changes since v1: Explain what the patch fixes in the title (Vinod) Add Dan as reporter using Reported-by tag (Vinod) --- --- drivers/dma/stm32-dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c index 12f3a3e..047476a 100644 --- a/drivers/dma/stm32-dma.c +++ b/drivers/dma/stm32-dma.c @@ -437,7 +437,7 @@ static int stm32_dma_start_transfer(struct stm32_dma_chan *chan) if (!chan->desc) { vdesc = vchan_next_desc(&chan->vchan); if (!vdesc) - return 0; + return -EPERM; chan->desc = to_stm32_dma_desc(vdesc); chan->next_sg = 0; @@ -559,7 +559,7 @@ static void stm32_dma_issue_pending(struct dma_chan *c) if (!chan->busy) { if (vchan_issue_pending(&chan->vchan) && !chan->desc) { ret = stm32_dma_start_transfer(chan); - if ((chan->desc->cyclic) && (!ret)) + if ((!ret) && (chan->desc->cyclic)) stm32_dma_configure_next_sg(chan); } }