[PATCH 1/2] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()

[PATCH 1/2] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()

[Sachin Kamat]

'r->cfg' is being checked for NULL. However, it is dereferenced
in the previous statements. Thus moving those statements within
the check.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
---
 drivers/dma/pl330.c |   16 +++++++++-------
 1 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 2343d7d..018a445 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id, struct pl330_req *r)
 		goto xfer_exit;
 	}
 
-	/* Prefer Secure Channel */
-	if (!_manager_ns(thrd))
-		r->cfg->nonsecure = 0;
-	else
-		r->cfg->nonsecure = 1;
 
 	/* Use last settings, if not provided */
-	if (r->cfg)
+	if (r->cfg) {
+		/* Prefer Secure Channel */
+		if (!_manager_ns(thrd))
+			r->cfg->nonsecure = 0;
+		else
+			r->cfg->nonsecure = 1;
+
 		ccr = _prepare_ccr(r->cfg);
-	else
+	} else {
 		ccr = readl(regs + CC(thrd->id));
+	}
 
 	/* If this req doesn't have valid xfer settings */
 	if (!_is_valid(ccr)) {
-- 
1.7.4.1

[PATCH 2/2] DMA: PL330: Check the pointer returned by kzalloc

[Sachin Kamat]

kzalloc could return NULL. Hence add a check to avoid
NULL pointer dereference.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
---
 drivers/dma/pl330.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 018a445..5d3bbcd 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2930,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 		num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
 
 	pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+	if (!pdmac->peripherals) {
+		ret = -ENOMEM;
+		dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
+		goto probe_err5;
+	}
 
 	for (i = 0; i < num_chan; i++) {
 		pch = &pdmac->peripherals[i];
-- 
1.7.4.1

Re: [PATCH 2/2] DMA: PL330: Check the pointer returned by kzalloc

[Jassi Brar]

On Mon, Sep 17, 2012 at 3:20 PM, Sachin Kamat <sachin.kamat@linaro.org> wrote:
> kzalloc could return NULL. Hence add a check to avoid
> NULL pointer dereference.
>
> Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>

Patch 1 and 2, both
Acked-by: Jassi Brar <jassisinghbrar@gmail.com>

Re: [PATCH 2/2] DMA: PL330: Check the pointer returned by kzalloc

[Vinod Koul]

On Mon, 2012-09-17 at 15:20 +0530, Sachin Kamat wrote:
> kzalloc could return NULL. Hence add a check to avoid
> NULL pointer dereference.
> 
> Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
> ---
>  drivers/dma/pl330.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
> index 018a445..5d3bbcd 100644
> --- a/drivers/dma/pl330.c
> +++ b/drivers/dma/pl330.c
> @@ -2930,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
>  		num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
>  
>  	pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
> +	if (!pdmac->peripherals) {
> +		ret = -ENOMEM;
> +		dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
> +		goto probe_err5;
> +	}
>  
>  	for (i = 0; i < num_chan; i++) {
>  		pch = &pdmac->peripherals[i];

Thanks applied both to fixes. 
I have cc'ed stable as well

-- 
~Vinod