diff options
author | M'boumba Cedric Madianga <cedric.madianga@gmail.com> | 2015-12-07 06:00:28 -0500 |
---|---|---|
committer | Vinod Koul <vinod.koul@intel.com> | 2015-12-09 23:15:22 -0500 |
commit | aea08a5dfadf387153cdbbff89f775b0e19d32e4 (patch) | |
tree | e131357f4158ae6de8a7ce51b06983ca80c48dc1 | |
parent | b341b4a13ca2c6ea8a426a9befb4dec0d7040860 (diff) |
dmaengine: stm32-dma: Fix unchecked deference of chan->desc
'commit d8b468394fb7 ("dmaengine: Add STM32 DMA driver")' leads to the
following Smatch complaint:
drivers/dma/stm32-dma.c:562 stm32_dma_issue_pending()
error: we previously assumed 'chan->desc' could be null (see line 560)
So, this patch fixes the unchecked dereference of chan->desc by returning
operation not permitted error when stm32_dma_start_transfer() does not
succeed to allocate a virtual channel descriptor.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: M'boumba Cedric Madianga <cedric.madianga@gmail.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
-rw-r--r-- | drivers/dma/stm32-dma.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c index 12f3a3eddba9..047476a1383d 100644 --- a/drivers/dma/stm32-dma.c +++ b/drivers/dma/stm32-dma.c | |||
@@ -437,7 +437,7 @@ static int stm32_dma_start_transfer(struct stm32_dma_chan *chan) | |||
437 | if (!chan->desc) { | 437 | if (!chan->desc) { |
438 | vdesc = vchan_next_desc(&chan->vchan); | 438 | vdesc = vchan_next_desc(&chan->vchan); |
439 | if (!vdesc) | 439 | if (!vdesc) |
440 | return 0; | 440 | return -EPERM; |
441 | 441 | ||
442 | chan->desc = to_stm32_dma_desc(vdesc); | 442 | chan->desc = to_stm32_dma_desc(vdesc); |
443 | chan->next_sg = 0; | 443 | chan->next_sg = 0; |
@@ -559,7 +559,7 @@ static void stm32_dma_issue_pending(struct dma_chan *c) | |||
559 | if (!chan->busy) { | 559 | if (!chan->busy) { |
560 | if (vchan_issue_pending(&chan->vchan) && !chan->desc) { | 560 | if (vchan_issue_pending(&chan->vchan) && !chan->desc) { |
561 | ret = stm32_dma_start_transfer(chan); | 561 | ret = stm32_dma_start_transfer(chan); |
562 | if ((chan->desc->cyclic) && (!ret)) | 562 | if ((!ret) && (chan->desc->cyclic)) |
563 | stm32_dma_configure_next_sg(chan); | 563 | stm32_dma_configure_next_sg(chan); |
564 | } | 564 | } |
565 | } | 565 | } |