* [PATCH AUTOSEL 4.19 02/39] dmaengine: dw-axi-dmac: fix null dereference when pointer first is null
[not found] <20190614202946.27385-1-sashal@kernel.org>
@ 2019-06-14 20:29 ` Sasha Levin
2019-06-14 20:29 ` [PATCH AUTOSEL 4.19 03/39] dmaengine: sprd: Fix block length overflow Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2019-06-14 20:29 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Colin Ian King, Vinod Koul, Sasha Levin, dmaengine
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 0788611c9a0925c607de536b2449de5ed98ef8df ]
In the unlikely event that axi_desc_get returns a null desc in the
very first iteration of the while-loop the error exit path ends
up calling axi_desc_put on a null pointer 'first' and this causes
a null pointer dereference. Fix this by adding a null check on
pointer 'first' before calling axi_desc_put.
Addresses-Coverity: ("Explicit null dereference")
Fixes: 1fe20f1b8454 ("dmaengine: Introduce DW AXI DMAC driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index c4eb55e3011c..c05ef7f1d7b6 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -512,7 +512,8 @@ dma_chan_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dst_adr,
return vchan_tx_prep(&chan->vc, &first->vd, flags);
err_desc_get:
- axi_desc_put(first);
+ if (first)
+ axi_desc_put(first);
return NULL;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH AUTOSEL 4.19 03/39] dmaengine: sprd: Fix block length overflow
[not found] <20190614202946.27385-1-sashal@kernel.org>
2019-06-14 20:29 ` [PATCH AUTOSEL 4.19 02/39] dmaengine: dw-axi-dmac: fix null dereference when pointer first is null Sasha Levin
@ 2019-06-14 20:29 ` Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2019-06-14 20:29 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Eric Long, Baolin Wang, Vinod Koul, Sasha Levin, dmaengine
From: Eric Long <eric.long@unisoc.com>
[ Upstream commit 89d03b3c126d683f7b2cd5b07178493993d12448 ]
The maximum value of block length is 0xffff, so if the configured transfer length
is more than 0xffff, that will cause block length overflow to lead a configuration
error.
Thus we can set block length as the maximum burst length to avoid this issue, since
the maximum burst length will not be a big value which is more than 0xffff.
Signed-off-by: Eric Long <eric.long@unisoc.com>
Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sprd-dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
index 55df0d41355b..1ed1c7efa288 100644
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -663,7 +663,7 @@ static int sprd_dma_fill_desc(struct dma_chan *chan,
temp |= slave_cfg->src_maxburst & SPRD_DMA_FRG_LEN_MASK;
hw->frg_len = temp;
- hw->blk_len = len & SPRD_DMA_BLK_LEN_MASK;
+ hw->blk_len = slave_cfg->src_maxburst & SPRD_DMA_BLK_LEN_MASK;
hw->trsc_len = len & SPRD_DMA_TRSC_LEN_MASK;
temp = (dst_step & SPRD_DMA_TRSF_STEP_MASK) << SPRD_DMA_DEST_TRSF_STEP_OFFSET;
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-14 20:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20190614202946.27385-1-sashal@kernel.org>
2019-06-14 20:29 ` [PATCH AUTOSEL 4.19 02/39] dmaengine: dw-axi-dmac: fix null dereference when pointer first is null Sasha Levin
2019-06-14 20:29 ` [PATCH AUTOSEL 4.19 03/39] dmaengine: sprd: Fix block length overflow Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).