Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

staging: mt7621-dma: fix potentially dereferencing uninitialized 'tx_desc'

Function 'mtk_hsdma_start_transfer' uses 'tx_desc' pointer which can be
dereferenced before it is initializated. Initializate pointer before
avoiding the problem.

Fixes: 0853c7a53eb3 ("staging: mt7621-dma: ralink: add rt2880 dma engine")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Sergio Paracuellos and committed by
Greg Kroah-Hartman
354e3796 4dc2a3cd

+2 -1
+2 -1
drivers/staging/mt7621-dma/mtk-hsdma.c
··· 335 335 /* tx desc */ 336 336 src = sg->src_addr; 337 337 for (i = 0; i < chan->desc->num_sgs; i++) { 338 + tx_desc = &chan->tx_ring[chan->tx_idx]; 339 + 338 340 if (len > HSDMA_MAX_PLEN) 339 341 tlen = HSDMA_MAX_PLEN; 340 342 else ··· 346 344 tx_desc->addr1 = src; 347 345 tx_desc->flags |= HSDMA_DESC_PLEN1(tlen); 348 346 } else { 349 - tx_desc = &chan->tx_ring[chan->tx_idx]; 350 347 tx_desc->addr0 = src; 351 348 tx_desc->flags = HSDMA_DESC_PLEN0(tlen); 352 349