Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

dma: at_xdmac: fix a missing check on list iterator

The bug is here:
__func__, desc, &desc->tx_dma_desc.phys, ret, cookie, residue);

The list iterator 'desc' will point to a bogus position containing
HEAD if the list is empty or no element is found. To avoid dev_dbg()
prints a invalid address, use a new variable 'iter' as the list
iterator, while use the origin variable 'desc' as a dedicated
pointer to point to the found element.

Cc: stable@vger.kernel.org
Fixes: 82e2424635f4c ("dmaengine: xdmac: fix print warning on dma_addr_t variable")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220327061154.4867-1-xiam0nd.tong@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Xiaomeng Tong and committed by
Vinod Koul
206680c4 a3ae97f4

+7 -5
+7 -5
drivers/dma/at_xdmac.c
··· 1453 1453 { 1454 1454 struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan); 1455 1455 struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device); 1456 - struct at_xdmac_desc *desc, *_desc; 1456 + struct at_xdmac_desc *desc, *_desc, *iter; 1457 1457 struct list_head *descs_list; 1458 1458 enum dma_status ret; 1459 1459 int residue, retry; ··· 1568 1568 * microblock. 1569 1569 */ 1570 1570 descs_list = &desc->descs_list; 1571 - list_for_each_entry_safe(desc, _desc, descs_list, desc_node) { 1572 - dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg); 1573 - residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth; 1574 - if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda) 1571 + list_for_each_entry_safe(iter, _desc, descs_list, desc_node) { 1572 + dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg); 1573 + residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth; 1574 + if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) { 1575 + desc = iter; 1575 1576 break; 1577 + } 1576 1578 } 1577 1579 residue += cur_ubc << dwidth; 1578 1580