A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

dmaengine: msm_gpi: fix to avoid null pointer access

Browse source 
A null pointer dereference is possible in gpi_prep_slave_sg.
Client drivers will allocate buffer and initiate bus xfer
through qup over i2c. I2c geni driver will queue the buffer
address to TRE'S using scatter-gather. Clients can pass NULL
buffer, so added null pointer check before accessing the TRE.

This is leading to dereferencing null pointer issue.
To solve this, add check for null in transfer ring.

Change-Id: I3a25a7da0d38c58f725e0996c458b1fb64c0fe09
Signed-off-by: Anil Veshala Veshala <quic_aveshala@quicinc.com>
Signed-off-by: Somesh Dey <quic_somedey@quicinc.com>
Signed-off-by: Zahir Shabbir Khan <quic_zshabbir@quicinc.com>
This commit is contained in:
Zahir Shabbir Khan 2025-03-04 12:03:30 +05:30 • committed by Somesh Dey
commit e11076b7df
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
drivers/dma/qcom/gpi.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/atomic.h>
@ -2524,6 +2525,12 @@ struct dma_async_tx_descriptor *gpi_prep_slave_sg(struct dma_chan *chan,
for_each_sg(sgl, sg, sg_len, i) {
tre = sg_virt(sg);
if (!tre) {
kfree(gpi_desc);
GPII_ERR(gpii, gpii_chan->chid, "TRE address is null\n");
return NULL;
}
if (sg_len == 1) {
tre_type =
MSM_GPI_TRE_TYPE(((struct msm_gpi_tre *)tre));