diff options
| author | Sebastian von Ohr <vonohr@smaract.com> | 2020-03-03 14:05:18 +0100 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2020-04-15 21:42:11 +0530 |
| commit | b269426011bcfd97b7c3101abfe1a99147b6f40b (patch) | |
| tree | 96e729dae0ec64fd5aa4dfff5de6f9975ed9c7ad /drivers/dma | |
| parent | 172d59ecd61b89f535ad99a7e531c0f111453b9a (diff) | |
| download | linux-b269426011bcfd97b7c3101abfe1a99147b6f40b.tar.gz linux-b269426011bcfd97b7c3101abfe1a99147b6f40b.tar.bz2 linux-b269426011bcfd97b7c3101abfe1a99147b6f40b.zip | |
dmaengine: xilinx_dma: Add missing check for empty list
The DMA transfer might finish just after checking the state with
dma_cookie_status, but before the lock is acquired. Not checking
for an empty list in xilinx_dma_tx_status may result in reading
random data or data corruption when desc is written to. This can
be reliably triggered by using dma_sync_wait to wait for DMA
completion.
Signed-off-by: Sebastian von Ohr <vonohr@smaract.com>
Tested-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Link: https://lore.kernel.org/r/20200303130518.333-1-vonohr@smaract.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'drivers/dma')
| -rw-r--r-- | drivers/dma/xilinx/xilinx_dma.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c index aecd5a35a296..5429497d3560 100644 --- a/drivers/dma/xilinx/xilinx_dma.c +++ b/drivers/dma/xilinx/xilinx_dma.c @@ -1230,16 +1230,16 @@ static enum dma_status xilinx_dma_tx_status(struct dma_chan *dchan, return ret; spin_lock_irqsave(&chan->lock, flags); - - desc = list_last_entry(&chan->active_list, - struct xilinx_dma_tx_descriptor, node); - /* - * VDMA and simple mode do not support residue reporting, so the - * residue field will always be 0. - */ - if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA) - residue = xilinx_dma_get_residue(chan, desc); - + if (!list_empty(&chan->active_list)) { + desc = list_last_entry(&chan->active_list, + struct xilinx_dma_tx_descriptor, node); + /* + * VDMA and simple mode do not support residue reporting, so the + * residue field will always be 0. + */ + if (chan->has_sg && chan->xdev->dma_config->dmatype != XDMA_TYPE_VDMA) + residue = xilinx_dma_get_residue(chan, desc); + } spin_unlock_irqrestore(&chan->lock, flags); dma_set_residue(txstate, residue); |