dmaengine: sprd: Fix the possible crash when getting descriptor status [Linux 5.2]

dmaengine: sprd: Fix the possible crash when getting descriptor status [Linux 5.2]

This Linux kernel change "dmaengine: sprd: Fix the possible crash when getting descriptor status" is included in the Linux 5.2 release. This change is authored by Baolin Wang <baolin.wang [at] linaro.org> on Mon May 6 15:28:28 2019 +0800. The commit for this change in Linux stable tree is 16d0f85 (patch).

dmaengine: sprd: Fix the possible crash when getting descriptor status

We will get a NULL virtual descriptor by vchan_find_desc() when the descriptor
has been submitted, that will crash the kernel when getting the descriptor
status.

In this case, since the descriptor has been submitted to process, but it
is not completed now, which means the descriptor is listed into the
'vc->desc_submitted' list now. So we can not get current processing descriptor
by vchan_find_desc(), but the pointer 'schan->cur_desc' will point to the
current processing descriptor, then we can use 'schan->cur_desc' to get
current processing descriptor's status to avoid this issue.

Signed-off-by: Baolin Wang <[email protected]>
Signed-off-by: Vinod Koul <[email protected]>

There are 2 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/dma/sprd-dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
index 48431e2..e29342a 100644
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -625,7 +625,7 @@ static enum dma_status sprd_dma_tx_status(struct dma_chan *chan,
        else
            pos = 0;
    } else if (schan->cur_desc && schan->cur_desc->vd.tx.cookie == cookie) {
-       struct sprd_dma_desc *sdesc = to_sprd_dma_desc(vd);
+       struct sprd_dma_desc *sdesc = schan->cur_desc;

        if (sdesc->dir == DMA_DEV_TO_MEM)
            pos = sprd_dma_get_dst_addr(schan);

Leave a Reply

Your email address will not be published. Required fields are marked *