From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 687CDC433E0 for ; Thu, 21 May 2020 11:46:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 387F2207FB for ; Thu, 21 May 2020 11:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729080AbgEULq0 (ORCPT ); Thu, 21 May 2020 07:46:26 -0400 Received: from relmlor1.renesas.com ([210.160.252.171]:59267 "EHLO relmlie5.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729064AbgEULqZ (ORCPT ); Thu, 21 May 2020 07:46:25 -0400 X-IronPort-AV: E=Sophos;i="5.73,417,1583161200"; d="scan'208";a="47677965" Received: from unknown (HELO relmlir5.idc.renesas.com) ([10.200.68.151]) by relmlie5.idc.renesas.com with ESMTP; 21 May 2020 20:46:24 +0900 Received: from localhost.localdomain (unknown [10.166.252.89]) by relmlir5.idc.renesas.com (Postfix) with ESMTP id 96AE14004BA8; Thu, 21 May 2020 20:46:24 +0900 (JST) From: Yoshihiro Shimoda To: vkoul@kernel.org Cc: dmaengine@vger.kernel.org, linux-renesas-soc@vger.kernel.org, Yoshihiro Shimoda Subject: [PATCH] dma: sh: usb-dmac: Fix residue after the commit 24461d9792c2 Date: Thu, 21 May 2020 20:46:13 +0900 Message-Id: <1590061573-12576-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 2.7.4 Sender: linux-renesas-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-renesas-soc@vger.kernel.org This driver assumed that freed descriptors have "done_cookie". But, after the commit 24461d9792c2 ("dmaengine: virt-dma: Fix access after free in vchan_complete()"), since the desc is freed after callback function was called, this driver could not match any done_cookie when a client driver (renesas_usbhs driver) calls dmaengine_tx_status() in the callback function. So, add to check both descriptor types (freed and got) to fix the issue. Reported-by: Hien Dang Fixes: 24461d9792c2 ("dmaengine: virt-dma: Fix access after free in vchan_complete()") Signed-off-by: Yoshihiro Shimoda --- drivers/dma/sh/usb-dmac.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c index b218a01..c0adc1c8 100644 --- a/drivers/dma/sh/usb-dmac.c +++ b/drivers/dma/sh/usb-dmac.c @@ -488,16 +488,17 @@ static u32 usb_dmac_chan_get_residue_if_complete(struct usb_dmac_chan *chan, dma_cookie_t cookie) { struct usb_dmac_desc *desc; - u32 residue = 0; + list_for_each_entry_reverse(desc, &chan->desc_got, node) { + if (desc->done_cookie == cookie) + return desc->residue; + } list_for_each_entry_reverse(desc, &chan->desc_freed, node) { - if (desc->done_cookie == cookie) { - residue = desc->residue; - break; - } + if (desc->done_cookie == cookie) + return desc->residue; } - return residue; + return 0; } static u32 usb_dmac_chan_get_residue(struct usb_dmac_chan *chan, -- 2.7.4