Commit c5157b76 authored by Ioan Nicu's avatar Ioan Nicu Committed by Linus Torvalds

rapidio: fix rio_dma_transfer error handling

Some of the mport_dma_req structure members were initialized late
inside the do_dma_request() function, just before submitting the
request to the dma engine. But we have some error branches before
that. In case of such an error, the code would return on the error
path and trigger the calling of dma_req_free() with a req structure
which is not completely initialized. This causes a NULL pointer
dereference in dma_req_free().

This patch fixes these error branches by making sure that all
necessary mport_dma_req structure members are initialized in
rio_dma_transfer() immediately after the request structure gets
allocated.

Link: http://lkml.kernel.org/r/20180412150605.GA31409@nokia.com
Fixes: bbd876ad ("rapidio: use a reference count for struct mport_dma_req")
Signed-off-by: default avatarIoan Nicu <ioan.nicu.ext@nokia.com>
Tested-by: default avatarAlexander Sverdlin <alexander.sverdlin@nokia.com>
Acked-by: default avatarAlexandre Bounine <alex.bou9@gmail.com>
Cc: Barry Wood <barry.wood@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Frank Kunz <frank.kunz@nokia.com>
Cc: <stable@vger.kernel.org>	[4.6+]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e71769ae
...@@ -740,10 +740,7 @@ static int do_dma_request(struct mport_dma_req *req, ...@@ -740,10 +740,7 @@ static int do_dma_request(struct mport_dma_req *req,
tx->callback = dma_xfer_callback; tx->callback = dma_xfer_callback;
tx->callback_param = req; tx->callback_param = req;
req->dmach = chan;
req->sync = sync;
req->status = DMA_IN_PROGRESS; req->status = DMA_IN_PROGRESS;
init_completion(&req->req_comp);
kref_get(&req->refcount); kref_get(&req->refcount);
cookie = dmaengine_submit(tx); cookie = dmaengine_submit(tx);
...@@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, ...@@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
if (!req) if (!req)
return -ENOMEM; return -ENOMEM;
kref_init(&req->refcount);
ret = get_dma_channel(priv); ret = get_dma_channel(priv);
if (ret) { if (ret) {
kfree(req); kfree(req);
return ret; return ret;
} }
chan = priv->dmach;
kref_init(&req->refcount);
init_completion(&req->req_comp);
req->dir = dir;
req->filp = filp;
req->priv = priv;
req->dmach = chan;
req->sync = sync;
/* /*
* If parameter loc_addr != NULL, we are transferring data from/to * If parameter loc_addr != NULL, we are transferring data from/to
...@@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, ...@@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
xfer->offset, xfer->length); xfer->offset, xfer->length);
} }
req->dir = dir;
req->filp = filp;
req->priv = priv;
chan = priv->dmach;
nents = dma_map_sg(chan->device->dev, nents = dma_map_sg(chan->device->dev,
req->sgt.sgl, req->sgt.nents, dir); req->sgt.sgl, req->sgt.nents, dir);
if (nents == 0) { if (nents == 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment