lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53CBCFBF.1040208@metafoo.de>
Date:	Sun, 20 Jul 2014 16:18:39 +0200
From:	Lars-Peter Clausen <lars@...afoo.de>
To:	Javier Martinez Canillas <javier.martinez@...labora.co.uk>,
	Dan Williams <dan.j.williams@...el.com>
CC:	Vinod Koul <vinod.koul@...el.com>, dmaengine@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/1] dmaengine: pl330: Check if the DMA descriptor is
 NULL

On 07/19/2014 03:21 AM, Javier Martinez Canillas wrote:
> Commit 6079d38 ("dmaengine: pl330: Remove useless xfer_cb indirection")
> removed the __callback() function which created an unnecessary level of
> indirection to execute the tranfer callback .xfer_cb
>
> Unfortunately the commit also changed the semantics slightly since that
> function used to check if the request was not NULL before attempting to
> execute the callback function. Not checking this could lead to a kernel
> NULL pointer dereference error.

This should not happen, but I guess it can happen when terminal_all() is 
called. (It's wrong to try to complete a descriptor from terminal_all() in 
the first place, but that's a different issue)

>
> Signed-off-by: Javier Martinez Canillas <javier.martinez@...labora.co.uk>

Acked-by: Lars-Peter Clausen <lars@...afoo.de>

> ---
>   drivers/dma/pl330.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
> index bc5878a..a55d754 100644
> --- a/drivers/dma/pl330.c
> +++ b/drivers/dma/pl330.c
> @@ -1441,9 +1441,14 @@ xfer_exit:
>
>   static void dma_pl330_rqcb(struct dma_pl330_desc *desc, enum pl330_op_err err)
>   {
> -	struct dma_pl330_chan *pch = desc->pchan;
> +	struct dma_pl330_chan *pch;
>   	unsigned long flags;
>
> +	if (!desc)
> +		return;
> +
> +	pch = desc->pchan;
> +
>   	/* If desc aborted */
>   	if (!pch)
>   		return;
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists