diff options
| author | Gustavo A. R. Silva <garsilva@embeddedor.com> | 2017-11-20 09:28:14 -0500 |
|---|---|---|
| committer | Vinod Koul <vinod.koul@intel.com> | 2017-11-29 09:18:17 -0500 |
| commit | 62a277d43d47e74972de44d33bd3763e31992414 (patch) | |
| tree | 4b91a3bff3d3537ecd82fc3ca959517a66f464ec /drivers | |
| parent | 5c9afbda911ce20b3f2181d1e440a0222e1027dd (diff) | |
dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
_xt_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference.
Fix this by moving the pointer dereference after _xt_ has been null
checked.
This issue was detected with the help of Coccinelle.
Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/dma/at_hdmac.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c index fbab271b3bf9..a861b5b4d443 100644 --- a/drivers/dma/at_hdmac.c +++ b/drivers/dma/at_hdmac.c | |||
| @@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan, | |||
| 708 | unsigned long flags) | 708 | unsigned long flags) |
| 709 | { | 709 | { |
| 710 | struct at_dma_chan *atchan = to_at_dma_chan(chan); | 710 | struct at_dma_chan *atchan = to_at_dma_chan(chan); |
| 711 | struct data_chunk *first = xt->sgl; | 711 | struct data_chunk *first; |
| 712 | struct at_desc *desc = NULL; | 712 | struct at_desc *desc = NULL; |
| 713 | size_t xfer_count; | 713 | size_t xfer_count; |
| 714 | unsigned int dwidth; | 714 | unsigned int dwidth; |
| @@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan, | |||
| 720 | if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) | 720 | if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) |
| 721 | return NULL; | 721 | return NULL; |
| 722 | 722 | ||
| 723 | first = xt->sgl; | ||
| 724 | |||
| 723 | dev_info(chan2dev(chan), | 725 | dev_info(chan2dev(chan), |
| 724 | "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", | 726 | "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", |
| 725 | __func__, &xt->src_start, &xt->dst_start, xt->numf, | 727 | __func__, &xt->src_start, &xt->dst_start, xt->numf, |
