From d7c83909d1645347e84fd07a5c5ef465db72bc9f Mon Sep 17 00:00:00 2001 From: wormuz <3341798+wormuz@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:27:44 +0300 Subject: [PATCH] dmaengine: dma-jz4780: fix NULL dereference in tx_status jz4780_dma_tx_status() dereferences jzchan->desc->vdesc.tx.cookie without checking jzchan->desc. When the status of a completed transfer is queried after the channel finished (or was terminated) and no descriptor is active, jzchan->desc is NULL and the comparison faults. Reproduced on JZ4770 (RG350P handheld): querying residue from the MMC path after a completed transfer races the completion handler clearing jzchan->desc. Check jzchan->desc before comparing the cookie; with no active descriptor the residue lookup falls through to the default (0), which is correct for a completed transfer. Signed-off-by: wormuz <3341798+wormuz@users.noreply.github.com> --- drivers/dma/dma-jz4780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c index 100057603fd4e1..0d727257854d4a 100644 --- a/drivers/dma/dma-jz4780.c +++ b/drivers/dma/dma-jz4780.c @@ -658,7 +658,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, /* On the issued list, so hasn't been processed yet */ residue = jz4780_dma_desc_residue(jzchan, to_jz4780_dma_desc(vdesc), 0); - } else if (cookie == jzchan->desc->vdesc.tx.cookie) { + } else if (jzchan->desc && cookie == jzchan->desc->vdesc.tx.cookie) { residue = jz4780_dma_desc_residue(jzchan, jzchan->desc, jzchan->curr_hwdesc + 1); }