From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753493AbbEEBe7 (ORCPT ); Mon, 4 May 2015 21:34:59 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:50940 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752556AbbEEBXF (ORCPT ); Mon, 4 May 2015 21:23:05 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Mark Brown" , "Andy Shevchenko" Date: Tue, 05 May 2015 02:16:39 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 108/221] spi: dw-mid: avoid potential NULL dereference In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.249 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.69-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Andy Shevchenko commit c9dafb27c84412fe4b17c3b94cc4ffeef5df1833 upstream. When DMA descriptor allocation fails we should not try to assign any fields in the bad descriptor. The patch adds the necessary checks for that. Fixes: 7063c0d942a1 (spi/dw_spi: add DMA support) Signed-off-by: Andy Shevchenko Signed-off-by: Mark Brown [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings --- drivers/spi/spi-dw-mid.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/spi/spi-dw-mid.c +++ b/drivers/spi/spi-dw-mid.c @@ -155,6 +155,9 @@ static int mid_spi_dma_transfer(struct d 1, DMA_TO_DEVICE, DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_DEST_UNMAP); + if (!txdesc) + return NULL; + txdesc->callback = dw_spi_dma_done; txdesc->callback_param = dws; @@ -177,6 +180,9 @@ static int mid_spi_dma_transfer(struct d 1, DMA_FROM_DEVICE, DMA_PREP_INTERRUPT | DMA_COMPL_SKIP_DEST_UNMAP); + if (!rxdesc) + return NULL; + rxdesc->callback = dw_spi_dma_done; rxdesc->callback_param = dws;