Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d05568a authored by wwang's avatar wwang Committed by Greg Kroah-Hartman
Browse files

staging:rts_pstor:Fix possible panic by NULL pointer dereference 



rtsx_transport.c (rtsx_transfer_sglist_adma_partial):
pointer struct scatterlist *sg, which is mapped in dma_map_sg,
is used as an iterator in later transfer operation. It is corrupted and
passed to dma_unmap_sg, thus causing fatal unmap of some erroneous address.
Fix it by duplicating *sg_ptr for iterating.

Signed-off-by: default avatarwwang <wei_wang@realsil.com.cn>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4ca5218e

drivers/staging/rts_pstor/rtsx_transport.c

+6 −5
Original line number Original line Diff line number Diff line
@@ -335,6 +335,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, 
	int sg_cnt, i, resid;

	int sg_cnt, i, resid;

	int err = 0;

	int err = 0;

	long timeleft;

	long timeleft;

	struct scatterlist *sg_ptr;

	u32 val = TRIG_DMA;

	u32 val = TRIG_DMA;





	if ((sg == NULL) || (num_sg <= 0) || !offset || !index)

	if ((sg == NULL) || (num_sg <= 0) || !offset || !index)
@@ -371,7 +372,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, 
	sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir);

	sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir);





	resid = size;

	resid = size;



	sg_ptr = sg;

	chip->sgi = 0;

	chip->sgi = 0;

	/* Usually the next entry will be @sg@ + 1, but if this sg element

	/* Usually the next entry will be @sg@ + 1, but if this sg element

	 * is part of a chained scatterlist, it could jump to the start of

	 * is part of a chained scatterlist, it could jump to the start of
@@ -379,14 +380,14 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, 
	 * the proper sg

	 * the proper sg

	 */

	 */

	for (i = 0; i < *index; i++)

	for (i = 0; i < *index; i++)

		sg = sg_next(sg);

		sg_ptr = sg_next(sg_ptr);

	for (i = *index; i < sg_cnt; i++) {

	for (i = *index; i < sg_cnt; i++) {

		dma_addr_t addr;

		dma_addr_t addr;

		unsigned int len;

		unsigned int len;

		u8 option;

		u8 option;





		addr = sg_dma_address(sg);

		addr = sg_dma_address(sg_ptr);

		len = sg_dma_len(sg);

		len = sg_dma_len(sg_ptr);





		RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n",

		RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n",

			     (unsigned int)addr, len);

			     (unsigned int)addr, len);
@@ -415,7 +416,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card, 
		if (!resid)

		if (!resid)

			break;

			break;





		sg = sg_next(sg);

		sg_ptr = sg_next(sg_ptr);

	}

	}





	RTSX_DEBUGP("SG table count = %d\n", chip->sgi);

	RTSX_DEBUGP("SG table count = %d\n", chip->sgi);