[PATCH v2] dmaengine: qcom: hidma: fix memory corruption when active list is empty

[PATCH v2] dmaengine: qcom: hidma: fix memory corruption when active list is empty

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

list_first_entry() does not check if the list is empty. When mchan->active
is empty it returns a bogus pointer, which causes memory corruption.

Use list_first_entry_or_null() instead.

This issue was found by static analysis.

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
v1: https://lore.kernel.org/r/20261023073154.744365-1-lixicaicai@gmail.com
v2: rewrite the commit message in simpler words as suggested by Frank
Li; no code change.

 drivers/dma/qcom/hidma.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index c939635be..925c912e0 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -176,8 +176,9 @@ static void hidma_callback(void *data)
 		queued = true;
 
 		/* calculate the next running descriptor */
-		mchan->running = list_first_entry(&mchan->active,
-						  struct hidma_desc, node);
+		mchan->running = list_first_entry_or_null(&mchan->active,
+							  struct hidma_desc,
+							  node);
 	}
 	spin_unlock_irqrestore(&mchan->lock, irqflags);
 
@@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
 	}
 
 	if (!mchan->running) {
-		struct hidma_desc *desc = list_first_entry(&mchan->active,
-							   struct hidma_desc,
-							   node);
+		struct hidma_desc *desc;
+
+		desc = list_first_entry_or_null(&mchan->active,
+						struct hidma_desc, node);
 		mchan->running = desc;
 	}
 	spin_unlock_irqrestore(&mchan->lock, flags);
-- 
2.30.2

Re: [PATCH v2] dmaengine: qcom: hidma: fix memory corruption when active list is empty

[Frank Li]

On Tue, Nov 03, 2026 at 04:32:14PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@gmail.com>
>
> list_first_entry() does not check if the list is empty. When mchan->active
> is empty it returns a bogus pointer, which causes memory corruption.
>
> Use list_first_entry_or_null() instead.
>
> This issue was found by static analysis.
>
> Reported-by: Wang Haoran <haoranwangsec@gmail.com>
> Reported-by: Li Ximo <lixicaicai@gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

> v1: https://lore.kernel.org/r/20261023073154.744365-1-lixicaicai@gmail.com
> v2: rewrite the commit message in simpler words as suggested by Frank
> Li; no code change.
>
>  drivers/dma/qcom/hidma.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
> index c939635be..925c912e0 100644
> --- a/drivers/dma/qcom/hidma.c
> +++ b/drivers/dma/qcom/hidma.c
> @@ -176,8 +176,9 @@ static void hidma_callback(void *data)
>  		queued = true;
>
>  		/* calculate the next running descriptor */
> -		mchan->running = list_first_entry(&mchan->active,
> -						  struct hidma_desc, node);
> +		mchan->running = list_first_entry_or_null(&mchan->active,
> +							  struct hidma_desc,
> +							  node);
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, irqflags);
>
> @@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
>  	}
>
>  	if (!mchan->running) {
> -		struct hidma_desc *desc = list_first_entry(&mchan->active,
> -							   struct hidma_desc,
> -							   node);
> +		struct hidma_desc *desc;
> +
> +		desc = list_first_entry_or_null(&mchan->active,
> +						struct hidma_desc, node);
>  		mchan->running = desc;
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, flags);
> --
> 2.30.2