dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
authorAdrian Larumbe <adrian.martinezlarumbe@imgtec.com>
Tue, 6 Jul 2021 23:43:38 +0000 (00:43 +0100)
committerVinod Koul <vkoul@kernel.org>
Wed, 14 Jul 2021 05:09:34 +0000 (10:39 +0530)
commit7dd2dd4ff9f3abda601f22b9d01441a0869d20d7
tree09a73d44196efee072a23170a49ed242f2ab9a12
parente73f0f0ee7541171d89f2e2491130c7771ba58d3
dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers

When user calls dmaengine_terminate_sync, the driver will clean up any
remaining descriptors for all the pending or active transfers that had
previously been submitted. However, this might happen whilst the tasklet is
invoking the DMA callback for the last finished transfer, so by the time it
returns and takes over the channel's spinlock, the list of completed
descriptors it was traversing is no longer valid. This leads to a
read-after-free situation.

Fix it by signalling whether a user-triggered termination has happened by
means of a boolean variable.

Signed-off-by: Adrian Larumbe <adrian.martinezlarumbe@imgtec.com>
Link: https://lore.kernel.org/r/20210706234338.7696-3-adrian.martinezlarumbe@imgtec.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
drivers/dma/xilinx/xilinx_dma.c