[PATCH] dmaengine: qcom: hidma: fix wild pointer stored in mchan->running when active list is empty

[PATCH] dmaengine: qcom: hidma: fix wild pointer stored in mchan->running when active list is empty

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

While auditing list_first_entry() users we found two call sites in the
HIDMA driver that invoke it on mchan->active without verifying the list
is non-empty. list_first_entry() never returns NULL: on an empty list
head->next == head, so container_of() produces a bogus non-NULL pointer
into the enclosing hidma_chan structure instead. That wild pointer is
stored into mchan->running, and is later dereferenced in
hidma_tx_status() where "if (mchan->running) runcookie =
mchan->running->desc.cookie" passes precisely because the pointer is
not NULL, yielding an out-of-bounds read / memory corruption.

The list can be empty at both sites on entirely normal paths. In
hidma_callback(), the completed descriptor is first moved from active
to completed; when it was the last active descriptor, the subsequent
list_first_entry() runs on the now-empty list. In
hidma_issue_pending(), a client calling dma_async_issue_pending()
without any queued descriptor leaves both queued and active empty, and
the "if (!mchan->running)" branch then fetches the "first" entry of an
empty active list.

Fix both sites by switching to list_first_entry_or_null(), which
returns NULL for an empty list. This makes the existing NULL check on
mchan->running in hidma_tx_status() effective, so the paused-channel
cookie query takes the -EINVAL path instead of dereferencing a wild
pointer. Both call sites already run under mchan->lock, so no
additional locking is needed.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
 drivers/dma/qcom/hidma.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index c939635be..925c912e0 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -176,8 +176,9 @@ static void hidma_callback(void *data)
 		queued = true;
 
 		/* calculate the next running descriptor */
-		mchan->running = list_first_entry(&mchan->active,
-						  struct hidma_desc, node);
+		mchan->running = list_first_entry_or_null(&mchan->active,
+							  struct hidma_desc,
+							  node);
 	}
 	spin_unlock_irqrestore(&mchan->lock, irqflags);
 
@@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
 	}
 
 	if (!mchan->running) {
-		struct hidma_desc *desc = list_first_entry(&mchan->active,
-							   struct hidma_desc,
-							   node);
+		struct hidma_desc *desc;
+
+		desc = list_first_entry_or_null(&mchan->active,
+						struct hidma_desc, node);
 		mchan->running = desc;
 	}
 	spin_unlock_irqrestore(&mchan->lock, flags);
-- 
2.30.2

Re: [PATCH] dmaengine: qcom: hidma: fix wild pointer stored in mchan->running when active list is empty

[Frank Li]

On Fri, Oct 23, 2026 at 03:31:54PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@gmail.com>
>
> While auditing list_first_entry() users we found two call sites in the
> HIDMA driver that invoke it on mchan->active without verifying the list
> is non-empty. list_first_entry() never returns NULL: on an empty list
> head->next == head, so container_of() produces a bogus non-NULL pointer
> into the enclosing hidma_chan structure instead. That wild pointer is
> stored into mchan->running, and is later dereferenced in
> hidma_tx_status() where "if (mchan->running) runcookie =
> mchan->running->desc.cookie" passes precisely because the pointer is
> not NULL, yielding an out-of-bounds read / memory corruption.
>
> The list can be empty at both sites on entirely normal paths. In
> hidma_callback(), the completed descriptor is first moved from active
> to completed; when it was the last active descriptor, the subsequent
> list_first_entry() runs on the now-empty list. In
> hidma_issue_pending(), a client calling dma_async_issue_pending()
> without any queued descriptor leaves both queued and active empty, and
> the "if (!mchan->running)" branch then fetches the "first" entry of an
> empty active list.
>
> Fix both sites by switching to list_first_entry_or_null(), which
> returns NULL for an empty list. This makes the existing NULL check on
> mchan->running in hidma_tx_status() effective, so the paused-channel
> cookie query takes the -EINVAL path instead of dereferencing a wild
> pointer. Both call sites already run under mchan->lock, so no
> additional locking is needed.
>

Can you use simple words.

dmaengine: qcom: hidma: fix memory corruption when active list is empty

list_first_entry() does not check if the list is empty. When mchan->active
is empty it returns a bogus pointer, which causing memory corruption.

Use list_first_entry_or_null() instead.

Frank

> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
> ---
>  drivers/dma/qcom/hidma.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
> index c939635be..925c912e0 100644
> --- a/drivers/dma/qcom/hidma.c
> +++ b/drivers/dma/qcom/hidma.c
> @@ -176,8 +176,9 @@ static void hidma_callback(void *data)
>  		queued = true;
>
>  		/* calculate the next running descriptor */
> -		mchan->running = list_first_entry(&mchan->active,
> -						  struct hidma_desc, node);
> +		mchan->running = list_first_entry_or_null(&mchan->active,
> +							  struct hidma_desc,
> +							  node);
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, irqflags);
>
> @@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
>  	}
>
>  	if (!mchan->running) {
> -		struct hidma_desc *desc = list_first_entry(&mchan->active,
> -							   struct hidma_desc,
> -							   node);
> +		struct hidma_desc *desc;
> +
> +		desc = list_first_entry_or_null(&mchan->active,
> +						struct hidma_desc, node);
>  		mchan->running = desc;
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, flags);
> --
> 2.30.2
>