AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-21 19:19:57 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
0d5a03c3d9
linux_dsm_epyc7002/drivers/rapidio
History
Ioan Nicu c5157b7686 rapidio: fix rio_dma_transfer error handling 
Some of the mport_dma_req structure members were initialized late
inside the do_dma_request() function, just before submitting the
request to the dma engine. But we have some error branches before
that. In case of such an error, the code would return on the error
path and trigger the calling of dma_req_free() with a req structure
which is not completely initialized. This causes a NULL pointer
dereference in dma_req_free().

This patch fixes these error branches by making sure that all
necessary mport_dma_req structure members are initialized in
rio_dma_transfer() immediately after the request structure gets
allocated.

Link: http://lkml.kernel.org/r/20180412150605.GA31409@nokia.com
Fixes: bbd876adb8 ("rapidio: use a reference count for struct mport_dma_req")
Signed-off-by: Ioan Nicu <ioan.nicu.ext@nokia.com>
Tested-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Acked-by: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Barry Wood <barry.wood@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Logan Gunthorpe <logang@deltatee.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Frank Kunz <frank.kunz@nokia.com>
Cc: <stable@vger.kernel.org>	[4.6+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-04-20 17:18:35 -07:00
..
devices rapidio: fix rio_dma_transfer error handling 2018-04-20 17:18:35 -07:00
switches rapidio: constify rio_device_id 2017-11-17 16:10:03 -08:00
Kconfig rapidio: add RapidIO channelized messaging driver 2016-08-02 19:35:31 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rio_cm.c rapidio/rio_cm: use memdup_user() instead of duplicating code 2016-10-11 15:06:32 -07:00
rio-access.c rapidio: remove global irq spinlocks from the subsystem 2017-10-03 17:54:24 -07:00
rio-driver.c
rio-scan.c drivers/rapidio/rio-scan.c: fix typo in comment 2018-04-11 10:28:37 -07:00
rio-sysfs.c rapidio: use is_visible() to hide switch-specific attributes 2017-03-17 15:10:49 +09:00
rio.c rapidio: move 12 EXPORT_SYMBOL_GPL() calls to function implementations 2018-02-06 18:32:46 -08:00
rio.h rapidio: use is_visible() to hide switch-specific attributes 2017-03-17 15:10:49 +09:00