Patch "dmaengine: dw-axi-dmac: Do not dereference NULL structure" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dmaengine: dw-axi-dmac: Do not dereference NULL structure

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 40941fbce88dfcef852d1abb91bc078b2bbf6f76
Author: Kees Cook <keescook@xxxxxxxxxxxx>
Date:   Fri Jan 27 14:36:27 2023 -0800

    dmaengine: dw-axi-dmac: Do not dereference NULL structure
    
    [ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ]
    
    If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave
    "bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds:
    
    ../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status':
    ../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct
    virt_dma_desc[46116860184273879]' [-Warray-bounds=]
      329 |                 bytes = vd_to_axi_desc(vdesc)->length;
          |                                              ^~
    
    Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity")
    Cc: Eugeniy Paltsev <Eugeniy.Paltsev@xxxxxxxxxxxx>
    Cc: Vinod Koul <vkoul@xxxxxxxxxx>
    Cc: dmaengine@xxxxxxxxxxxxxxx
    Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230127223623.never.507-kees@xxxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
index bf85aa0979ecb..152c5d98524d7 100644
--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
@@ -325,8 +325,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie,
 		len = vd_to_axi_desc(vdesc)->hw_desc[0].len;
 		completed_length = completed_blocks * len;
 		bytes = length - completed_length;
-	} else {
-		bytes = vd_to_axi_desc(vdesc)->length;
 	}
 
 	spin_unlock_irqrestore(&chan->vc.lock, flags);