lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 7 Dec 2017 14:04:03 +0100 From: Ludovic BARRE <ludovic.barre@...com> To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, <linux-kernel@...r.kernel.org> CC: <stable@...r.kernel.org>, Mboumba Cedric Madianga <cedric.madianga@...il.com>, Vinod Koul <vinod.koul@...el.com>, Sasha Levin <alexander.levin@...izon.com> Subject: Re: [PATCH 4.9 038/109] dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status add Pierre-yves Mordret acked-by: Ludovic BARRE <ludovic.barre@...com> On 12/07/2017 01:56 PM, Greg Kroah-Hartman wrote: > 4.9-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: M'boumba Cedric Madianga <cedric.madianga@...il.com> > > > [ Upstream commit 57b5a32135c813f2ab669039fb4ec16b30cb3305 ] > > chan->desc is always set to NULL when a DMA transfer is complete. > As a DMA transfer could be complete during the call of stm32_dma_tx_status, > we need to be sure that chan->desc is not NULL before using this variable > to avoid a null pointer deference issue. > > Signed-off-by: M'boumba Cedric Madianga <cedric.madianga@...il.com> > Reviewed-by: Ludovic BARRE <ludovic.barre@...com> > Signed-off-by: Vinod Koul <vinod.koul@...el.com> > Signed-off-by: Sasha Levin <alexander.levin@...izon.com> > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> > --- > drivers/dma/stm32-dma.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > --- a/drivers/dma/stm32-dma.c > +++ b/drivers/dma/stm32-dma.c > @@ -884,7 +884,7 @@ static enum dma_status stm32_dma_tx_stat > struct virt_dma_desc *vdesc; > enum dma_status status; > unsigned long flags; > - u32 residue; > + u32 residue = 0; > > status = dma_cookie_status(c, cookie, state); > if ((status == DMA_COMPLETE) || (!state)) > @@ -892,16 +892,12 @@ static enum dma_status stm32_dma_tx_stat > > spin_lock_irqsave(&chan->vchan.lock, flags); > vdesc = vchan_find_desc(&chan->vchan, cookie); > - if (cookie == chan->desc->vdesc.tx.cookie) { > + if (chan->desc && cookie == chan->desc->vdesc.tx.cookie) > residue = stm32_dma_desc_residue(chan, chan->desc, > chan->next_sg); > - } else if (vdesc) { > + else if (vdesc) > residue = stm32_dma_desc_residue(chan, > to_stm32_dma_desc(vdesc), 0); > - } else { > - residue = 0; > - } > - > dma_set_residue(state, residue); > > spin_unlock_irqrestore(&chan->vchan.lock, flags); > >
Powered by blists - more mailing lists