Re: [PATCH] rapidio: fix rio_dma_transfer error handling

[Andrew Morton]

On Thu, 12 Apr 2018 17:06:05 +0200 Ioan Nicu <ioan.nicu.ext@xxxxxxxxx> wrote:

> Some of the mport_dma_req structure members were initialized late
> inside the do_dma_request() function, just before submitting the
> request to the dma engine. But we have some error branches before
> that. In case of such an error, the code would return on the error
> path and trigger the calling of dma_req_free() with a req structure
> which is not completely initialized. This causes a NULL pointer
> dereference in dma_req_free().
> 
> This patch fixes these error branches by making sure that all
> necessary mport_dma_req structure members are initialized in
> rio_dma_transfer() immediately after the request structure gets
> allocated.

This sounds like something which someone has actually triggered in a
real-world situation.  So I added a cc:stable.  Please let me know if
that was inappropriate.

And please remember to always include all information regarding
end-user impact when fixing bugs.