From patchwork Fri Dec 20 13:11:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Ujfalusi X-Patchwork-Id: 182268 Delivered-To: patch@linaro.org Received: by 2002:a92:1f98:0:0:0:0:0 with SMTP id f24csp508820ilf; Fri, 20 Dec 2019 05:10:54 -0800 (PST) X-Google-Smtp-Source: APXvYqxPaLy5K9pruSjWk2V64e+9LZJ/m4bw0hElf8ujMhGPccJ+rWBLN7Og6WduF1W2vs6IOM8s X-Received: by 2002:a05:6830:13d9:: with SMTP id e25mr14425136otq.134.1576847454847; Fri, 20 Dec 2019 05:10:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1576847454; cv=none; d=google.com; s=arc-20160816; b=c/pZEJ6IWIZNdcmHoYJNJB+LK3OwGt4KnUWPoeZ5nTjK2Qcn1Axx3P455Z8XgAnXfG XpXdlzRXEHgtosB1YssGV2wy+/5M0CXme2BOL6Hul35OSDzZfhLdsHDwBNqXG+B6YgXR rzznuPeNU+2cTXMefIo6C8yCKKh5p7+HElT05+yYSwuv9ViYSByIxO+r8t7AMxtmelLF ShEFV4r6PVorK6tQ7iRFd09knceM7QgzyIE5APsT7yeDaNxbWwCrOuglZ9i3klrIupeg m+EkKppkc3hPPdHnPIqzXgiToqUWc2m2Ldt1VkILeQqPZWHkWeYLYX+4kJ8hi18Wjg0x 78bA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=CrGd70iz1Y/kL9JoOYs6SZJaCBp8X7flypShA4QWAzs=; b=m+XgIjdKsoD2VhnXg/8c3QEQqQTl/SowbF88eEJCVSpG39mOO3O4OrzTocsenX4hjy 0lF9lDGTdTSEgI8kkBN2pwmUBOPTw/iIiO0IhCWY1NtzmsoqYMm6UAkv6CwUl32uVkgn USoIWJP1ufqDMpz60KpspivyJf45wPhV1+ge+V2xtOGGnt4E0ddI/t9DFXBE4rD5qcqU 5RKEbe0fIchUH91kIdZ6YAYtN5fKxIz6hSZDcxWcExCwh0k9fuBuDHZ1lrqrFQc/Y+Mt p8dS5YH1A3Nv90xqGhK0WSbyHk1hZ7yYZh0pkHiWeTuFHvHVuA/FQW1e6gF3cWslf6oK s5/A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=waABWkBJ; spf=pass (google.com: best guess record for domain of dmaengine-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=dmaengine-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q20si2059380otn.297.2019.12.20.05.10.54; Fri, 20 Dec 2019 05:10:54 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of dmaengine-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=waABWkBJ; spf=pass (google.com: best guess record for domain of dmaengine-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=dmaengine-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=NONE dis=NONE) header.from=ti.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727370AbfLTNKy (ORCPT + 3 others); Fri, 20 Dec 2019 08:10:54 -0500 Received: from fllv0016.ext.ti.com ([198.47.19.142]:58242 "EHLO fllv0016.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727360AbfLTNKy (ORCPT ); Fri, 20 Dec 2019 08:10:54 -0500 Received: from lelv0265.itg.ti.com ([10.180.67.224]) by fllv0016.ext.ti.com (8.15.2/8.15.2) with ESMTP id xBKDAjWP036270; Fri, 20 Dec 2019 07:10:45 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1576847445; bh=CrGd70iz1Y/kL9JoOYs6SZJaCBp8X7flypShA4QWAzs=; h=From:To:CC:Subject:Date; b=waABWkBJtdDJEHDxFHywY6xfuLxvr9slMJ+wJ67viR8iJ+eTIEYrwvxkeR85iaf5O W/2/sXsqPFQ77lSTgRr5rkg3PXXNYkKEmCmuD1rtsEj+3wUa0zFymsJcNMjGdCA16e Sb/OrWPcQxhu6wEFpQ8W9+ZM3D/THLE19gHUub6k= Received: from DFLE104.ent.ti.com (dfle104.ent.ti.com [10.64.6.25]) by lelv0265.itg.ti.com (8.15.2/8.15.2) with ESMTPS id xBKDAjEm124875 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 20 Dec 2019 07:10:45 -0600 Received: from DFLE100.ent.ti.com (10.64.6.21) by DFLE104.ent.ti.com (10.64.6.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1847.3; Fri, 20 Dec 2019 07:10:44 -0600 Received: from fllv0039.itg.ti.com (10.64.41.19) by DFLE100.ent.ti.com (10.64.6.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1847.3 via Frontend Transport; Fri, 20 Dec 2019 07:10:44 -0600 Received: from feketebors.ti.com (ileax41-snat.itg.ti.com [10.172.224.153]) by fllv0039.itg.ti.com (8.15.2/8.15.2) with ESMTP id xBKDAgAe035079; Fri, 20 Dec 2019 07:10:43 -0600 From: Peter Ujfalusi To: CC: , , , , Subject: [PATCH] dmaengine: virt-dma: Fix access after free in vcna_complete() Date: Fri, 20 Dec 2019 15:11:00 +0200 Message-ID: <20191220131100.21804-1-peter.ujfalusi@ti.com> X-Mailer: git-send-email 2.24.0 MIME-Version: 1.0 X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Sender: dmaengine-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: dmaengine@vger.kernel.org vchan_vdesc_fini() is freeing up 'vd' so the access to vd->tx_result is via already freed up memory. Move the vchan_vdesc_fini() after invoking the callback to avoid this. Fixes: 09d5b702b0f97 ("dmaengine: virt-dma: store result on dma descriptor") Signed-off-by: Peter Ujfalusi --- drivers/dma/virt-dma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) -- Peter Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki. Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki Reviewed-by: Alexandru Ardelean diff --git a/drivers/dma/virt-dma.c b/drivers/dma/virt-dma.c index ec4adf4260a0..256fc662c500 100644 --- a/drivers/dma/virt-dma.c +++ b/drivers/dma/virt-dma.c @@ -104,9 +104,8 @@ static void vchan_complete(unsigned long arg) dmaengine_desc_get_callback(&vd->tx, &cb); list_del(&vd->node); - vchan_vdesc_fini(vd); - dmaengine_desc_callback_invoke(&cb, &vd->tx_result); + vchan_vdesc_fini(vd); } }