fsl_edma_desc_residue() dereferences fsl_chan->edesc, but it is checked for NULL only in one of two places where fsl_edma_desc_residue() is called from fsl_edma_tx_status(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrew Chernyakov <acherniakov@xxxxxxxxxxxxx> --- drivers/dma/fsl-edma-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c index a06a1575a2a5..fb712d85d556 100644 --- a/drivers/dma/fsl-edma-common.c +++ b/drivers/dma/fsl-edma-common.c @@ -330,7 +330,7 @@ enum dma_status fsl_edma_tx_status(struct dma_chan *chan, if (fsl_chan->edesc && cookie == fsl_chan->edesc->vdesc.tx.cookie) txstate->residue = fsl_edma_desc_residue(fsl_chan, vdesc, true); - else if (vdesc) + else if (fsl_chan->edesc && vdesc) txstate->residue = fsl_edma_desc_residue(fsl_chan, vdesc, false); else -- 2.35.1
