From patchwork Wed Jan 25 12:11:32 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mans Rullgard X-Patchwork-Id: 6405 Return-Path: X-Original-To: patchwork@peony.canonical.com Delivered-To: patchwork@peony.canonical.com Received: from fiordland.canonical.com (fiordland.canonical.com [91.189.94.145]) by peony.canonical.com (Postfix) with ESMTP id 8964623E0C for ; Wed, 25 Jan 2012 12:11:37 +0000 (UTC) Received: from mail-bk0-f52.google.com (mail-bk0-f52.google.com [209.85.214.52]) by fiordland.canonical.com (Postfix) with ESMTP id 736F9A18025 for ; Wed, 25 Jan 2012 12:11:37 +0000 (UTC) Received: by bkar19 with SMTP id r19so5200866bka.11 for ; Wed, 25 Jan 2012 04:11:37 -0800 (PST) MIME-Version: 1.0 Received: by 10.205.134.129 with SMTP id ic1mr6730644bkc.92.1327493497153; Wed, 25 Jan 2012 04:11:37 -0800 (PST) X-Forwarded-To: linaro-patchwork@canonical.com X-Forwarded-For: patch@linaro.org linaro-patchwork@canonical.com Delivered-To: patches@linaro.org Received: by 10.204.130.220 with SMTP id u28cs6314bks; Wed, 25 Jan 2012 04:11:36 -0800 (PST) Received: by 10.180.97.199 with SMTP id ec7mr27718759wib.8.1327493495686; Wed, 25 Jan 2012 04:11:35 -0800 (PST) Received: from unicorn.mansr.com (unicorn.mansr.com. [78.86.181.103]) by mx.google.com with ESMTP id f50si214846wed.70.2012.01.25.04.11.35; Wed, 25 Jan 2012 04:11:35 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of mru@mansr.com designates 78.86.181.103 as permitted sender) client-ip=78.86.181.103; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of mru@mansr.com designates 78.86.181.103 as permitted sender) smtp.mail=mru@mansr.com Received: by unicorn.mansr.com (Postfix, from userid 51770) id 0B58015390; Wed, 25 Jan 2012 12:11:35 +0000 (GMT) From: Mans Rullgard To: linux-arm-kernel@lists.infradead.org Cc: Javi Merino , linaro-dev@lists.linaro.org, patches@linaro.org, Russell King , Jassi Brar , linux-kernel@vger.kernel.org, Boojin Kim , Kukjin Kim , Sergei Shtylyov Subject: [PATCH] DMA: pl330: fix null pointer dereference in pl330_chan_ctrl() Date: Wed, 25 Jan 2012 12:11:32 +0000 Message-Id: <1327493492-31274-1-git-send-email-mans.rullgard@linaro.org> X-Mailer: git-send-email 1.7.8.4 In-Reply-To: <4F11F963.4050900@ru.mvista.com> References: <4F11F963.4050900@ru.mvista.com> X-Gm-Message-State: ALoCoQl0MK2wTOHij04tbOPLc5/QhOe4XB9+yjClW8QdxqFvw4kAqV9KVmm7mkf30r297WzS9XF/ This fixes the thrd->req_running field being accessed before thrd is checked for null. The error was introduced in abb959f (ARM: 7237/1: PL330: Fix driver freeze). Signed-off-by: Mans Rullgard --- drivers/dma/pl330.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c index add07e0..6278443 100644 --- a/drivers/dma/pl330.c +++ b/drivers/dma/pl330.c @@ -1568,12 +1568,13 @@ static int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op) struct pl330_thread *thrd = ch_id; struct pl330_dmac *pl330; unsigned long flags; - int ret = 0, active = thrd->req_running; + int ret = 0, active; if (!thrd || thrd->free || thrd->dmac->state == DYING) return -EINVAL; pl330 = thrd->dmac; + active = thrd->req_running; spin_lock_irqsave(&pl330->lock, flags);