staging:rts_pstor:Fix possible panic by NULL pointer dereference
rtsx_transport.c (rtsx_transfer_sglist_adma_partial): pointer struct scatterlist *sg, which is mapped in dma_map_sg, is used as an iterator in later transfer operation. It is corrupted and passed to dma_unmap_sg, thus causing fatal unmap of some erroneous address. Fix it by duplicating *sg_ptr for iterating. Signed-off-by: wwang <wei_wang@realsil.com.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4ca5218e39
commit
0d05568ac7
|
@ -335,6 +335,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
|
||||||
int sg_cnt, i, resid;
|
int sg_cnt, i, resid;
|
||||||
int err = 0;
|
int err = 0;
|
||||||
long timeleft;
|
long timeleft;
|
||||||
|
struct scatterlist *sg_ptr;
|
||||||
u32 val = TRIG_DMA;
|
u32 val = TRIG_DMA;
|
||||||
|
|
||||||
if ((sg == NULL) || (num_sg <= 0) || !offset || !index)
|
if ((sg == NULL) || (num_sg <= 0) || !offset || !index)
|
||||||
|
@ -371,7 +372,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
|
||||||
sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir);
|
sg_cnt = dma_map_sg(&(rtsx->pci->dev), sg, num_sg, dma_dir);
|
||||||
|
|
||||||
resid = size;
|
resid = size;
|
||||||
|
sg_ptr = sg;
|
||||||
chip->sgi = 0;
|
chip->sgi = 0;
|
||||||
/* Usually the next entry will be @sg@ + 1, but if this sg element
|
/* Usually the next entry will be @sg@ + 1, but if this sg element
|
||||||
* is part of a chained scatterlist, it could jump to the start of
|
* is part of a chained scatterlist, it could jump to the start of
|
||||||
|
@ -379,14 +380,14 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
|
||||||
* the proper sg
|
* the proper sg
|
||||||
*/
|
*/
|
||||||
for (i = 0; i < *index; i++)
|
for (i = 0; i < *index; i++)
|
||||||
sg = sg_next(sg);
|
sg_ptr = sg_next(sg_ptr);
|
||||||
for (i = *index; i < sg_cnt; i++) {
|
for (i = *index; i < sg_cnt; i++) {
|
||||||
dma_addr_t addr;
|
dma_addr_t addr;
|
||||||
unsigned int len;
|
unsigned int len;
|
||||||
u8 option;
|
u8 option;
|
||||||
|
|
||||||
addr = sg_dma_address(sg);
|
addr = sg_dma_address(sg_ptr);
|
||||||
len = sg_dma_len(sg);
|
len = sg_dma_len(sg_ptr);
|
||||||
|
|
||||||
RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n",
|
RTSX_DEBUGP("DMA addr: 0x%x, Len: 0x%x\n",
|
||||||
(unsigned int)addr, len);
|
(unsigned int)addr, len);
|
||||||
|
@ -415,7 +416,7 @@ static int rtsx_transfer_sglist_adma_partial(struct rtsx_chip *chip, u8 card,
|
||||||
if (!resid)
|
if (!resid)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
sg = sg_next(sg);
|
sg_ptr = sg_next(sg_ptr);
|
||||||
}
|
}
|
||||||
|
|
||||||
RTSX_DEBUGP("SG table count = %d\n", chip->sgi);
|
RTSX_DEBUGP("SG table count = %d\n", chip->sgi);
|
||||||
|
|
Loading…
Reference in New Issue