On Thu, 12 Apr 2018 17:06:05 +0200 Ioan Nicu <ioan.nicu....@nokia.com> wrote:
> Some of the mport_dma_req structure members were initialized late > inside the do_dma_request() function, just before submitting the > request to the dma engine. But we have some error branches before > that. In case of such an error, the code would return on the error > path and trigger the calling of dma_req_free() with a req structure > which is not completely initialized. This causes a NULL pointer > dereference in dma_req_free(). > > This patch fixes these error branches by making sure that all > necessary mport_dma_req structure members are initialized in > rio_dma_transfer() immediately after the request structure gets > allocated. This sounds like something which someone has actually triggered in a real-world situation. So I added a cc:stable. Please let me know if that was inappropriate. And please remember to always include all information regarding end-user impact when fixing bugs.
