Commit 206680c4 authored by Xiaomeng Tong's avatar Xiaomeng Tong Committed by Vinod Koul

dma: at_xdmac: fix a missing check on list iterator

The bug is here:
	__func__, desc, &desc->tx_dma_desc.phys, ret, cookie, residue);

The list iterator 'desc' will point to a bogus position containing
HEAD if the list is empty or no element is found. To avoid dev_dbg()
prints a invalid address, use a new variable 'iter' as the list
iterator, while use the origin variable 'desc' as a dedicated
pointer to point to the found element.

Cc: stable@vger.kernel.org
Fixes: 82e24246 ("dmaengine: xdmac: fix print warning on dma_addr_t variable")
Signed-off-by: default avatarXiaomeng Tong <xiam0nd.tong@gmail.com>
Link: https://lore.kernel.org/r/20220327061154.4867-1-xiam0nd.tong@gmail.comSigned-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent a3ae97f4
...@@ -1453,7 +1453,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, ...@@ -1453,7 +1453,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
{ {
struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan); struct at_xdmac_chan *atchan = to_at_xdmac_chan(chan);
struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device); struct at_xdmac *atxdmac = to_at_xdmac(atchan->chan.device);
struct at_xdmac_desc *desc, *_desc; struct at_xdmac_desc *desc, *_desc, *iter;
struct list_head *descs_list; struct list_head *descs_list;
enum dma_status ret; enum dma_status ret;
int residue, retry; int residue, retry;
...@@ -1568,11 +1568,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, ...@@ -1568,11 +1568,13 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
* microblock. * microblock.
*/ */
descs_list = &desc->descs_list; descs_list = &desc->descs_list;
list_for_each_entry_safe(desc, _desc, descs_list, desc_node) { list_for_each_entry_safe(iter, _desc, descs_list, desc_node) {
dwidth = at_xdmac_get_dwidth(desc->lld.mbr_cfg); dwidth = at_xdmac_get_dwidth(iter->lld.mbr_cfg);
residue -= (desc->lld.mbr_ubc & 0xffffff) << dwidth; residue -= (iter->lld.mbr_ubc & 0xffffff) << dwidth;
if ((desc->lld.mbr_nda & 0xfffffffc) == cur_nda) if ((iter->lld.mbr_nda & 0xfffffffc) == cur_nda) {
desc = iter;
break; break;
}
} }
residue += cur_ubc << dwidth; residue += cur_ubc << dwidth;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment