From patchwork Sun Sep 13 20:15:53 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Emilio_L=C3=B3pez?= X-Patchwork-Id: 517215 Return-Path: X-Original-To: incoming-imx@patchwork.ozlabs.org Delivered-To: patchwork-incoming-imx@bilbo.ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2001:1868:205::9]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 70B0A14076C for ; Mon, 14 Sep 2015 06:20:42 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=elopez.com.ar header.i=@elopez.com.ar header.b=YqAdf/HJ; dkim-atps=neutral Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZbDir-0001M8-FE; Sun, 13 Sep 2015 20:18:01 +0000 Received: from yotta.elopez.com.ar ([2a02:2ca0:aaa:d00d:c0de:4:f00d:cafe]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZbDio-00016Q-KK for linux-arm-kernel@lists.infradead.org; Sun, 13 Sep 2015 20:17:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=elopez.com.ar; s=mail; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Message-Id:Date:Subject:Cc:To:From; bh=ZPuMUt4NH2TgqKfv4OI5hdJHPQbpPbybtyMtP1CsLZ8=; b=YqAdf/HJefQuUtvA+JZFrQntnx 4kMFjLl31lL062X5jkauaPIb7IRkcIAWUKcecpa5D/MlrCYklQVVHGmOqDZv+XlB+sI1CP8MW7ykW tDG6+NpGdmfSKEP/q0grDnSHsM5a+3/KPhp5Fd5n9tLC0EVkwtf2Mx1RMVYEKQS2Rj2aKaJVB2ZeE Myz4kSL4Lm7kvpkg8bNpSPTzLMxoHjJBEuYqAPpgU5u6pUqKh2nYJFDH3a5942BIT1nfLQAnKwFjd ds/g+E/E/Eg7yzffwVo7ASiHd3VPDYwNSHOfV4bQ80tnI/Ke1l3rKlcCMBxUCugICHxCcuNlKXxSO rDh0Bv8w==; Received: from 201-212-128-157.cab.prima.net.ar ([201.212.128.157] helo=desktop.lan) by yotta.elopez.com.ar with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_CBC_SHA256:128) (Exim 4.86) id 1ZbDiL-0007Q1-Vo; Sun, 13 Sep 2015 17:17:30 -0300 From: =?UTF-8?q?Emilio=20L=C3=B3pez?= To: vinod.koul@intel.com, maxime.ripard@free-electrons.com Subject: [PATCH] dmaengine: sun4i: fix unsafe list iteration Date: Sun, 13 Sep 2015 17:15:53 -0300 Message-Id: <1442175353-4433-1-git-send-email-emilio@elopez.com.ar> X-Mailer: git-send-email 2.5.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150913_131759_259444_65470A57 X-CRM114-Status: UNSURE ( 9.91 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.0 (--) X-Spam-Report: SpamAssassin version 3.4.0 on bombadil.infradead.org summary: Content analysis details: (-2.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dmaengine@vger.kernel.org, =?UTF-8?q?Emilio=20L=C3=B3pez?= , dan.j.williams@intel.com, dan.carpenter@oracle.com, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+incoming-imx=patchwork.ozlabs.org@lists.infradead.org List-Id: linux-imx-kernel.lists.patchwork.ozlabs.org Currently, sun4i_dma_free_contract iterates over lists and frees memory as it goes through them, causing reads to recently freed memory to be performed. Fix this by using the safe version of the iterator, so freed memory is not referenced at all. Reported-by: Dan Carpenter Signed-off-by: Emilio López Acked-by: Maxime Ripard --- Hi, This is a patch to fix an issue pointed out by Dan on http://www.spinics.net/lists/dmaengine/msg05822.html I didn't get a chance to test a system with this, but it looks trivial enough and it builds. This should go in the -rc cycle, and there's no need for stable as the driver just landed this merge window. Cheers, Emilio drivers/dma/sun4i-dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/dma/sun4i-dma.c b/drivers/dma/sun4i-dma.c index a1a500d..1661d518 100644 --- a/drivers/dma/sun4i-dma.c +++ b/drivers/dma/sun4i-dma.c @@ -599,13 +599,13 @@ get_next_cyclic_promise(struct sun4i_dma_contract *contract) static void sun4i_dma_free_contract(struct virt_dma_desc *vd) { struct sun4i_dma_contract *contract = to_sun4i_dma_contract(vd); - struct sun4i_dma_promise *promise; + struct sun4i_dma_promise *promise, *tmp; /* Free all the demands and completed demands */ - list_for_each_entry(promise, &contract->demands, list) + list_for_each_entry_safe(promise, tmp, &contract->demands, list) kfree(promise); - list_for_each_entry(promise, &contract->completed_demands, list) + list_for_each_entry_safe(promise, tmp, &contract->completed_demands, list) kfree(promise); kfree(contract);