From d323ae468ef4eabf40de813b2156ace50c0b0ee7 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Thu, 13 Dec 2018 19:44:42 +0100 Subject: [PATCH] serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback BugLink: https://bugs.launchpad.net/bugs/1855787 [ Upstream commit 2e948218b7c1262a3830823d6620eb227e3d4e3a ] When falling back to PIO, active_rx must be set to a different value than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a match, leading to a NULL pointer dereference in rx_timer_fn() later. Use zero instead, which is the same value as after driver initialization. Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Kamal Mostafa Signed-off-by: Kleber Sacilotto de Souza --- drivers/tty/serial/sh-sci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index 89aa71c9df20..4ed1d9509343 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -1325,7 +1325,7 @@ fail: dmaengine_terminate_all(chan); for (i = 0; i < 2; i++) s->cookie_rx[i] = -EINVAL; - s->active_rx = -EINVAL; + s->active_rx = 0; sci_rx_dma_release(s, true); } -- 2.39.2