From patchwork Wed Dec 28 23:42:13 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Grygorii Strashko X-Patchwork-Id: 9490825 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C9EAB62AB0 for ; Wed, 28 Dec 2016 23:42:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BA0911FFBD for ; Wed, 28 Dec 2016 23:42:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ACC33223A6; Wed, 28 Dec 2016 23:42:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3771C1FFBD for ; Wed, 28 Dec 2016 23:42:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752065AbcL1XmS (ORCPT ); Wed, 28 Dec 2016 18:42:18 -0500 Received: from fllnx210.ext.ti.com ([198.47.19.17]:54073 "EHLO fllnx210.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751890AbcL1XmR (ORCPT ); Wed, 28 Dec 2016 18:42:17 -0500 Received: from dflxv15.itg.ti.com ([128.247.5.124]) by fllnx210.ext.ti.com (8.15.1/8.15.1) with ESMTP id uBSNgF2h028967; Wed, 28 Dec 2016 17:42:15 -0600 Received: from DLEE71.ent.ti.com (dlee71.ent.ti.com [157.170.170.114]) by dflxv15.itg.ti.com (8.14.3/8.13.8) with ESMTP id uBSNgFe9003926; Wed, 28 Dec 2016 17:42:15 -0600 Received: from dlep33.itg.ti.com (157.170.170.75) by DLEE71.ent.ti.com (157.170.170.114) with Microsoft SMTP Server id 14.3.294.0; Wed, 28 Dec 2016 17:42:14 -0600 Received: from legion.dal.design.ti.com (legion.dal.design.ti.com [128.247.22.53]) by dlep33.itg.ti.com (8.14.3/8.13.8) with ESMTP id uBSNgEHF020540; Wed, 28 Dec 2016 17:42:14 -0600 Received: from localhost (uda0226610.am.dhcp.ti.com [128.247.83.96]) by legion.dal.design.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id uBSNgE323409; Wed, 28 Dec 2016 17:42:14 -0600 (CST) From: Grygorii Strashko To: "David S. Miller" , , Mugunthan V N CC: Sekhar Nori , , , Ivan Khoronzhuk , Grygorii Strashko Subject: [PATCH] net: ethernet: ti: davinci_cpdma: fix access to uninitialized variable in cpdma_chan_set_descs() Date: Wed, 28 Dec 2016 17:42:13 -0600 Message-ID: <20161228234213.22166-1-grygorii.strashko@ti.com> X-Mailer: git-send-email 2.10.1.dirty MIME-Version: 1.0 Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Now below code sequence causes "Unable to handle kernel NULL pointer dereference.." exception and system crash during CPSW CPDMA initialization: cpsw_probe |-cpdma_chan_create (TX channel) |-cpdma_chan_split_pool |-cpdma_chan_set_descs(for TX channels) |-cpdma_chan_set_descs(for RX channels) [1] - and - static void cpdma_chan_set_descs(struct cpdma_ctlr *ctlr, int rx, int desc_num, int per_ch_desc) { struct cpdma_chan *chan, *most_chan = NULL; ... for (i = min; i < max; i++) { chan = ctlr->channels[i]; if (!chan) continue; ... if (most_dnum < chan->desc_num) { most_dnum = chan->desc_num; most_chan = chan; } } /* use remains */ most_chan->desc_num += desc_cnt; [2] } So, most_chan value will never be reassigned when cpdma_chan_set_descs() is called second time [1], because there are no RX channels yet and system will crash at [2]. Hence, fix the issue by checking most_chan for NULL before accessing it. Fixes: 0fc6432cc78d ("net: ethernet: ti: davinci_cpdma: add weight function for channels") Signed-off-by: Grygorii Strashko --- drivers/net/ethernet/ti/davinci_cpdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c index 36518fc..b349d572 100644 --- a/drivers/net/ethernet/ti/davinci_cpdma.c +++ b/drivers/net/ethernet/ti/davinci_cpdma.c @@ -708,7 +708,8 @@ static void cpdma_chan_set_descs(struct cpdma_ctlr *ctlr, } } /* use remains */ - most_chan->desc_num += desc_cnt; + if (most_chan) + most_chan->desc_num += desc_cnt; } /**