| Message ID | 20241029082845.1185380-1-chenridong@huaweicloud.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset | expand |
On 2024/10/29 16:28, Chen Ridong wrote: > From: Chen Ridong <chenridong@huawei.com> > > The at_xdmac_memset_create_desc may return NULL, which will lead to a > null pointer dereference. For example, the len input is error, or the > atchan->free_descs_list is empty and memory is exhausted. Therefore, add > check to avoid this. > > Fixes: b206d9a23ac7 ("dmaengine: xdmac: Add memset support") > Signed-off-by: Chen Ridong <chenridong@huawei.com> > --- > drivers/dma/at_xdmac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c > index 299396121e6d..e847ad66dc0b 100644 > --- a/drivers/dma/at_xdmac.c > +++ b/drivers/dma/at_xdmac.c > @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, > return NULL; > > desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); > + if (!desc) > + return NULL; > list_add_tail(&desc->desc_node, &desc->descs_list); > > desc->tx_dma_desc.cookie = -EBUSY; Friendly ping.
On 2024/10/29 16:28, Chen Ridong wrote: > From: Chen Ridong <chenridong@huawei.com> > > The at_xdmac_memset_create_desc may return NULL, which will lead to a > null pointer dereference. For example, the len input is error, or the > atchan->free_descs_list is empty and memory is exhausted. Therefore, add > check to avoid this. > > Fixes: b206d9a23ac7 ("dmaengine: xdmac: Add memset support") > Signed-off-by: Chen Ridong <chenridong@huawei.com> > --- > drivers/dma/at_xdmac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c > index 299396121e6d..e847ad66dc0b 100644 > --- a/drivers/dma/at_xdmac.c > +++ b/drivers/dma/at_xdmac.c > @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, > return NULL; > > desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); > + if (!desc) > + return NULL; > list_add_tail(&desc->desc_node, &desc->descs_list); > > desc->tx_dma_desc.cookie = -EBUSY; Friendly ping.
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 299396121e6d..e847ad66dc0b 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, return NULL; desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); + if (!desc) + return NULL; list_add_tail(&desc->desc_node, &desc->descs_list); desc->tx_dma_desc.cookie = -EBUSY;