The patch titled Subject: rapidio: fix rio_dma_transfer error handling has been added to the -mm tree. Its filename is rapidio-fix-rio_dma_transfer-error-handling.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/rapidio-fix-rio_dma_transfer-error-... and later at http://ozlabs.org/~akpm/mmotm/broken-out/rapidio-fix-rio_dma_transfer-error-...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Ioan Nicu ioan.nicu.ext@nokia.com Subject: rapidio: fix rio_dma_transfer error handling

Some of the mport_dma_req structure members were initialized late inside the do_dma_request() function, just before submitting the request to the dma engine. But we have some error branches before that. In case of such an error, the code would return on the error path and trigger the calling of dma_req_free() with a req structure which is not completely initialized. This causes a NULL pointer dereference in dma_req_free().

This patch fixes these error branches by making sure that all necessary mport_dma_req structure members are initialized in rio_dma_transfer() immediately after the request structure gets allocated.

Link: http://lkml.kernel.org/r/20180412150605.GA31409@nokia.com Signed-off-by: Ioan Nicu ioan.nicu.ext@nokia.com Tested-by: Alexander Sverdlin alexander.sverdlin@nokia.com Acked-by: Alexandre Bounine alex.bou9@gmail.com Cc: Barry Wood barry.wood@idt.com Cc: Matt Porter mporter@kernel.crashing.org Cc: Christophe JAILLET christophe.jaillet@wanadoo.fr Cc: Logan Gunthorpe logang@deltatee.com Cc: Chris Wilson chris@chris-wilson.co.uk Cc: Tvrtko Ursulin tvrtko.ursulin@intel.com Cc: Frank Kunz frank.kunz@nokia.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

drivers/rapidio/devices/rio_mport_cdev.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)

diff -puN drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling drivers/rapidio/devices/rio_mport_cdev.c --- a/drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-rio_dma_transfer-error-handling +++ a/drivers/rapidio/devices/rio_mport_cdev.c @@ -740,10 +740,7 @@ static int do_dma_request(struct mport_d tx->callback = dma_xfer_callback; tx->callback_param = req;

- req->dmach = chan; - req->sync = sync; req->status = DMA_IN_PROGRESS; - init_completion(&req->req_comp); kref_get(&req->refcount);

cookie = dmaengine_submit(tx); @@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 if (!req) return -ENOMEM;

- kref_init(&req->refcount); - ret = get_dma_channel(priv); if (ret) { kfree(req); return ret; } + chan = priv->dmach; + + kref_init(&req->refcount); + init_completion(&req->req_comp); + req->dir = dir; + req->filp = filp; + req->priv = priv; + req->dmach = chan; + req->sync = sync;

/* * If parameter loc_addr != NULL, we are transferring data from/to @@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 xfer->offset, xfer->length); }

- req->dir = dir; - req->filp = filp; - req->priv = priv; - chan = priv->dmach; - nents = dma_map_sg(chan->device->dev, req->sgt.sgl, req->sgt.nents, dir); if (nents == 0) { _

Patches currently in -mm which might be from ioan.nicu.ext@nokia.com are

rapidio-fix-rio_dma_transfer-error-handling.patch