From: Geert Uytterhoeven Date: Thu, 13 Dec 2018 18:44:42 +0000 (+0100) Subject: serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback X-Git-Tag: v4.19.88~199 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3e30e75bc15663d6e5fd56290c5bd296b1086e0f;p=thirdparty%2Fkernel%2Fstable.git serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback [ Upstream commit 2e948218b7c1262a3830823d6620eb227e3d4e3a ] When falling back to PIO, active_rx must be set to a different value than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a match, leading to a NULL pointer dereference in rx_timer_fn() later. Use zero instead, which is the same value as after driver initialization. Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index 5550289e6678b..9e1a6af23ca2b 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -1359,7 +1359,7 @@ fail: dmaengine_terminate_async(chan); for (i = 0; i < 2; i++) s->cookie_rx[i] = -EINVAL; - s->active_rx = -EINVAL; + s->active_rx = 0; s->chan_rx = NULL; sci_start_rx(port); if (!port_lock_held)