jz4780_dma_terminate_all() sets jzchan->desc to NULL. The cookie of a cyclic transfer never completes, so a later jz4780_dma_tx_status() call with that cookie finds no descriptor on the channel's lists, takes the else branch and reads jzchan->desc->vdesc.tx.cookie through the NULL pointer. The driver has always allowed this, but it only shows once something calls tx_status() on a terminated cyclic channel, as snd_dmaengine_pcm_sync_stop() does since commit 88e98af9f4b5 ("ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused"). Closing a playback stream then oopses: epc : jz4780_dma_tx_status+0x184/0x210 Call Trace: [<8048e104>] jz4780_dma_tx_status+0x184/0x210 [<805804d8>] snd_dmaengine_pcm_sync_stop+0x4c/0x94 [<8058f068>] snd_soc_pcm_component_sync_stop+0x80/0xc0 [<805775b8>] do_hw_free+0x20/0x6c [<80577650>] snd_pcm_release_substream+0x4c/0x9c [<805781ac>] snd_pcm_release+0x48/0x9c Only compare the cookie with the current descriptor's when there is one. Fixes: d894fc6046fe ("dmaengine: jz4780: add driver for the Ingenic JZ4780 DMA controller") Cc: stable@vger.kernel.org Signed-off-by: Olivier Louvignes --- Apologies to the stable list: two copies of this patch reached it earlier today from test sends, with the Cc trailer still in place. Please ignore those. This is the real submission, and it is the same patch. Seen on an Ingenic X1600 (HiBy R1, compatible "ingenic,x1830-dma" as fallback) on v7.3; the code is shared by all the SoCs this driver supports. The patch is build-tested on 734bef548a96 (v7.3-7363). drivers/dma/dma-jz4780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c index 6070dfdb7114..7f827be502f1 100644 --- a/drivers/dma/dma-jz4780.c +++ b/drivers/dma/dma-jz4780.c @@ -658,7 +658,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan, /* On the issued list, so hasn't been processed yet */ residue = jz4780_dma_desc_residue(jzchan, to_jz4780_dma_desc(vdesc), 0); - } else if (cookie == jzchan->desc->vdesc.tx.cookie) { + } else if (jzchan->desc && cookie == jzchan->desc->vdesc.tx.cookie) { residue = jz4780_dma_desc_residue(jzchan, jzchan->desc, jzchan->curr_hwdesc + 1); } base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b -- 2.39.5