linux-kernel - Re: [PATCH 1/1] dmaengine: pl330: Check if the DMA descriptor is NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 20 Jul 2014 16:18:39 +0200
From:	Lars-Peter Clausen <lars@...afoo.de>
To:	Javier Martinez Canillas <javier.martinez@...labora.co.uk>,
	Dan Williams <dan.j.williams@...el.com>
CC:	Vinod Koul <vinod.koul@...el.com>, dmaengine@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] dmaengine: pl330: Check if the DMA descriptor is
 NULL

On 07/19/2014 03:21 AM, Javier Martinez Canillas wrote:
> Commit 6079d38 ("dmaengine: pl330: Remove useless xfer_cb indirection")
> removed the __callback() function which created an unnecessary level of
> indirection to execute the tranfer callback .xfer_cb
>
> Unfortunately the commit also changed the semantics slightly since that
> function used to check if the request was not NULL before attempting to
> execute the callback function. Not checking this could lead to a kernel
> NULL pointer dereference error.

This should not happen, but I guess it can happen when terminal_all() is 
called. (It's wrong to try to complete a descriptor from terminal_all() in 
the first place, but that's a different issue)

>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@...labora.co.uk>

Acked-by: Lars-Peter Clausen <lars@...afoo.de>

> ---
>   drivers/dma/pl330.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
> index bc5878a..a55d754 100644
> --- a/drivers/dma/pl330.c
> +++ b/drivers/dma/pl330.c
> @@ -1441,9 +1441,14 @@ xfer_exit:
>
>   static void dma_pl330_rqcb(struct dma_pl330_desc *desc, enum pl330_op_err err)
>   {
> -	struct dma_pl330_chan *pch = desc->pchan;
> +	struct dma_pl330_chan *pch;
>   	unsigned long flags;
>
> +	if (!desc)
> +		return;
> +
> +	pch = desc->pchan;
> +
>   	/* If desc aborted */
>   	if (!pch)
>   		return;
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/