[PATCH] dmaengine: qcom: hidma: fix wild pointer stored in mchan->running when active list is empty

[Li Ximo]

From: Wang Haoran <haoranwangsec at gmail.com>

While auditing list_first_entry() users we found two call sites in the
HIDMA driver that invoke it on mchan->active without verifying the list
is non-empty. list_first_entry() never returns NULL: on an empty list
head->next == head, so container_of() produces a bogus non-NULL pointer
into the enclosing hidma_chan structure instead. That wild pointer is
stored into mchan->running, and is later dereferenced in
hidma_tx_status() where "if (mchan->running) runcookie =
mchan->running->desc.cookie" passes precisely because the pointer is
not NULL, yielding an out-of-bounds read / memory corruption.

The list can be empty at both sites on entirely normal paths. In
hidma_callback(), the completed descriptor is first moved from active
to completed; when it was the last active descriptor, the subsequent
list_first_entry() runs on the now-empty list. In
hidma_issue_pending(), a client calling dma_async_issue_pending()
without any queued descriptor leaves both queued and active empty, and
the "if (!mchan->running)" branch then fetches the "first" entry of an
empty active list.

Fix both sites by switching to list_first_entry_or_null(), which
returns NULL for an empty list. This makes the existing NULL check on
mchan->running in hidma_tx_status() effective, so the paused-channel
cookie query takes the -EINVAL path instead of dereferencing a wild
pointer. Both call sites already run under mchan->lock, so no
additional locking is needed.

Reported-by: Wang Haoran <haoranwangsec at gmail.com>
Reported-by: Li Ximo <lixicaicai at gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec at gmail.com>
---
 drivers/dma/qcom/hidma.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index c939635be..925c912e0 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -176,8 +176,9 @@ static void hidma_callback(void *data)
 		queued = true;
 
 		/* calculate the next running descriptor */
-		mchan->running = list_first_entry(&mchan->active,
-						  struct hidma_desc, node);
+		mchan->running = list_first_entry_or_null(&mchan->active,
+							  struct hidma_desc,
+							  node);
 	}
 	spin_unlock_irqrestore(&mchan->lock, irqflags);
 
@@ -238,9 +239,10 @@ static void hidma_issue_pending(struct dma_chan *dmach)
 	}
 
 	if (!mchan->running) {
-		struct hidma_desc *desc = list_first_entry(&mchan->active,
-							   struct hidma_desc,
-							   node);
+		struct hidma_desc *desc;
+
+		desc = list_first_entry_or_null(&mchan->active,
+						struct hidma_desc, node);
 		mchan->running = desc;
 	}
 	spin_unlock_irqrestore(&mchan->lock, flags);
-- 
2.30.2