From patchwork Mon Mar 4 16:52:57 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matt Porter X-Patchwork-Id: 2213451 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) by patchwork2.kernel.org (Postfix) with ESMTP id 7400EDF2F2 for ; Mon, 4 Mar 2013 16:56:08 +0000 (UTC) Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UCYd3-00081Q-TH; Mon, 04 Mar 2013 16:52:45 +0000 Received: from mail-ia0-x22b.google.com ([2607:f8b0:4001:c02::22b]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UCYcx-00080W-A8 for linux-arm-kernel@lists.infradead.org; Mon, 04 Mar 2013 16:52:43 +0000 Received: by mail-ia0-f171.google.com with SMTP id z13so5019170iaz.30 for ; Mon, 04 Mar 2013 08:52:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:sender:from:to:cc:subject:date:message-id:x-mailer; bh=oZDgktppLXCfcc0LAc/s27IAtzenU6ka0GV0WqOVQqI=; b=CAI1UYycDaVGDrVQ3PsZwtJ7LbLvIp4nKK58wKmyC57ik340sMrqotm37KyWdJFq46 8mbM4LTa/nvq0O93QVwYEFa7aBBHQMLjrL0HFief3+5rADb4Bs++i+DwA3U41aZRqC9A 0CegJT0eLVC9HVUFzoV/CboVXTbVlZreipkhXThIDB+VfPTKl0PSJz/SAJRA2nLQ0yI+ sr+M1c5oPnbsllLP3GiPdLbYSI/1chtJ8ywaef1h2bi6hrTWXICrJeV01RLFYH7A3fze S5Pd8YCXienRMECYh3uPRa7hFwgLsBhn4vqdsXKUNshJd/0eZnqRvl4tRpjZuGcHN0AS VZOQ== X-Received: by 10.50.155.134 with SMTP id vw6mr3028972igb.34.1362415957735; Mon, 04 Mar 2013 08:52:37 -0800 (PST) Received: from beef.ohporter.com (cpe-98-27-254-98.neo.res.rr.com. [98.27.254.98]) by mx.google.com with ESMTPS id uq1sm10055438igc.5.2013.03.04.08.52.36 (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 04 Mar 2013 08:52:37 -0800 (PST) From: Matt Porter To: Sekhar Nori Subject: [PATCH] arm: davinci: fix edma dmaengine induced null pointer dereference on da830 Date: Mon, 4 Mar 2013 11:52:57 -0500 Message-Id: <1362415977-12829-1-git-send-email-mporter@ti.com> X-Mailer: git-send-email 1.7.9.5 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130304_115239_435179_2B82196D X-CRM114-Status: GOOD ( 12.22 ) X-Spam-Score: -1.9 (-) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-1.9 points) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (ohiomdp[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: Linux DaVinci Kernel List , Tomas Novotny , stable@kernel.org, Linux ARM Kernel List X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org This adds additional error checking to the private edma api implementation to catch the case where the edma_alloc_slot() has an invalid controller parameter. The edma dmaengine wrapper driver relies on this condition being handled in order to avoid setting up a second edma dmaengine instance on DA830. Verfied using a DA850 with the second EDMA controller platform instance removed to simulate a DA830 which only has a single EDMA controller. Reported-by: Tomas Novotny Signed-off-by: Matt Porter Cc: stable@kernel.org --- arch/arm/mach-davinci/dma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-davinci/dma.c b/arch/arm/mach-davinci/dma.c index a685e97..f9eb836 100644 --- a/arch/arm/mach-davinci/dma.c +++ b/arch/arm/mach-davinci/dma.c @@ -747,6 +747,8 @@ int edma_alloc_slot(unsigned ctlr, int slot) slot = EDMA_CHAN_SLOT(slot); if (slot < 0) { + if (!edma_cc[ctlr]) + return -EINVAL; slot = edma_cc[ctlr]->num_channels; for (;;) { slot = find_next_zero_bit(edma_cc[ctlr]->edma_inuse,