rapidio: fix rio_dma_transfer error handling

Some of the mport_dma_req structure members were initialized late
inside the do_dma_request() function, just before submitting the
request to the dma engine. But we have some error branches before
that. In case of such an error, the code would return on the error
path and trigger the calling of dma_req_free() with a req structure
which is not completely initialized. This causes a NULL pointer
dereference in dma_req_free().

This patch fixes these error branches by making sure that all
necessary mport_dma_req structure members are initialized in
rio_dma_transfer() immediately after the request structure gets
allocated.

Link: http://lkml.kernel.org/r/[email protected]
Fixes: bbd876adb8c72 ("rapidio: use a reference count for struct mport_dma_req")
Signed-off-by: Ioan Nicu <[email protected]>
Tested-by: Alexander Sverdlin <[email protected]>
Acked-by: Alexandre Bounine <[email protected]>
Cc: Barry Wood <[email protected]>
Cc: Matt Porter <[email protected]>
Cc: Christophe JAILLET <[email protected]>
Cc: Logan Gunthorpe <[email protected]>
Cc: Chris Wilson <[email protected]>
Cc: Tvrtko Ursulin <[email protected]>
Cc: Frank Kunz <[email protected]>
Cc: <[email protected]>	[4.6+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

0 files changed, 0 insertions, 0 deletions