[PATCH v2] dmaengine: qcom: hidma: fix memory corruption when active list is empty

[Frank Li]

On Tue, Nov 03, 2026 at 04:32:14PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec at gmail.com>
>
> list_first_entry() does not check if the list is empty. When mchan->active
> is empty it returns a bogus pointer, which causes memory corruption.
>
> Use list_first_entry_or_null() instead.
>
> This issue was found by static analysis.
>
> Reported-by: Wang Haoran <haoranwangsec at gmail.com>
> Reported-by: Li Ximo <lixicaicai at gmail.com>
> Signed-off-by: Wang Haoran <haoranwangsec at gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li at nxp.com>

> v1: https://lore.kernel.org/r/20261023073154.744365-1-lixicaicai@gmail.com
> v2: rewrite the commit message in simpler words as suggested by Frank
> Li; no code change.
>
>  drivers/dma/qcom/hidma.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
> index c939635be..925c912e0 100644
> --- a/drivers/dma/qcom/hidma.c
> +++ b/drivers/dma/qcom/hidma.c
> @@ -176,8 +176,9 @@ static void hidma_callback(void *data)
>  		queued = true;
>
>  		/* calculate the next running descriptor */
> -		mchan->running = list_first_entry(&mchan->active,
> -						  struct hidma_desc, node);
> +		mchan->running = list_first_entry_or_null(&mchan->active,
> +							  struct hidma_desc,
> +							  node);
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, irqflags);
>
> @@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
>  	}
>
>  	if (!mchan->running) {
> -		struct hidma_desc *desc = list_first_entry(&mchan->active,
> -							   struct hidma_desc,
> -							   node);
> +		struct hidma_desc *desc;
> +
> +		desc = list_first_entry_or_null(&mchan->active,
> +						struct hidma_desc, node);
>  		mchan->running = desc;
>  	}
>  	spin_unlock_irqrestore(&mchan->lock, flags);
> --
> 2.30.2