| Message ID | 20241029082845.1185380-1-chenridong@huaweicloud.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | c43ec96e8d34399bd9dab2f2dc316b904892133f |
| Headers | show |
| Series | dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset | expand |
On 2024/10/29 16:28, Chen Ridong wrote: > From: Chen Ridong <chenridong@huawei.com> > > The at_xdmac_memset_create_desc may return NULL, which will lead to a > null pointer dereference. For example, the len input is error, or the > atchan->free_descs_list is empty and memory is exhausted. Therefore, add > check to avoid this. > > Fixes: b206d9a23ac7 ("dmaengine: xdmac: Add memset support") > Signed-off-by: Chen Ridong <chenridong@huawei.com> > --- > drivers/dma/at_xdmac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c > index 299396121e6d..e847ad66dc0b 100644 > --- a/drivers/dma/at_xdmac.c > +++ b/drivers/dma/at_xdmac.c > @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, > return NULL; > > desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); > + if (!desc) > + return NULL; > list_add_tail(&desc->desc_node, &desc->descs_list); > > desc->tx_dma_desc.cookie = -EBUSY; Friendly ping.
On 2024/10/29 16:28, Chen Ridong wrote: > From: Chen Ridong <chenridong@huawei.com> > > The at_xdmac_memset_create_desc may return NULL, which will lead to a > null pointer dereference. For example, the len input is error, or the > atchan->free_descs_list is empty and memory is exhausted. Therefore, add > check to avoid this. > > Fixes: b206d9a23ac7 ("dmaengine: xdmac: Add memset support") > Signed-off-by: Chen Ridong <chenridong@huawei.com> > --- > drivers/dma/at_xdmac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c > index 299396121e6d..e847ad66dc0b 100644 > --- a/drivers/dma/at_xdmac.c > +++ b/drivers/dma/at_xdmac.c > @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, > return NULL; > > desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); > + if (!desc) > + return NULL; > list_add_tail(&desc->desc_node, &desc->descs_list); > > desc->tx_dma_desc.cookie = -EBUSY; Friendly ping.
On Tue, 29 Oct 2024 08:28:45 +0000, Chen Ridong wrote: > The at_xdmac_memset_create_desc may return NULL, which will lead to a > null pointer dereference. For example, the len input is error, or the > atchan->free_descs_list is empty and memory is exhausted. Therefore, add > check to avoid this. > > Applied, thanks! [1/1] dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset commit: c43ec96e8d34399bd9dab2f2dc316b904892133f Best regards,
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c index 299396121e6d..e847ad66dc0b 100644 --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1363,6 +1363,8 @@ at_xdmac_prep_dma_memset(struct dma_chan *chan, dma_addr_t dest, int value, return NULL; desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); + if (!desc) + return NULL; list_add_tail(&desc->desc_node, &desc->descs_list); desc->tx_dma_desc.cookie = -EBUSY;