From e11076b7dfe33a2056930f63dd20a6e5c189029a Mon Sep 17 00:00:00 2001 From: Zahir Shabbir Khan Date: Tue, 4 Mar 2025 12:03:30 +0530 Subject: [PATCH] dmaengine: msm_gpi: fix to avoid null pointer access A null pointer dereference is possible in gpi_prep_slave_sg. Client drivers will allocate buffer and initiate bus xfer through qup over i2c. I2c geni driver will queue the buffer address to TRE'S using scatter-gather. Clients can pass NULL buffer, so added null pointer check before accessing the TRE. This is leading to dereferencing null pointer issue. To solve this, add check for null in transfer ring. Change-Id: I3a25a7da0d38c58f725e0996c458b1fb64c0fe09 Signed-off-by: Anil Veshala Veshala Signed-off-by: Somesh Dey Signed-off-by: Zahir Shabbir Khan --- drivers/dma/qcom/gpi.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c index 44e2e7de129e..eb9aea7851ff 100644 --- a/drivers/dma/qcom/gpi.c +++ b/drivers/dma/qcom/gpi.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2025, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -2524,6 +2525,12 @@ struct dma_async_tx_descriptor *gpi_prep_slave_sg(struct dma_chan *chan, for_each_sg(sgl, sg, sg_len, i) { tre = sg_virt(sg); + if (!tre) { + kfree(gpi_desc); + GPII_ERR(gpii, gpii_chan->chid, "TRE address is null\n"); + return NULL; + } + if (sg_len == 1) { tre_type = MSM_GPI_TRE_TYPE(((struct msm_gpi_tre *)tre));