github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg()

Browse Source 
loongson2_cmc_dma_prep_slave_sg() allocates the descriptor with
kzalloc_flex() before iterating over the scatterlist. If
loongson2_cmc_dma_set_xfer_param() fails inside the loop, the function
returns ERR_PTR(ret) without freeing the descriptor. At this point the
descriptor has not been handed to vchan_tx_prep() yet, so nothing else
will ever free it, leaking it on every failed ->device_prep_slave_sg()
call (e.g. an unsupported transfer direction or bus width).

The neighbouring error path for the num_items check already frees the
descriptor before returning; do the same on the set_xfer_param() failure
path.

Fixes: 1c0028e725 ("dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller")
Link: https://lore.kernel.org/all/20260818094957.7D2221F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012bUV3WshMSfTq61n1cgh1i
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260905062833.272484-1-diegomancera.dev@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
This commit is contained in:
Diego Fernando Mancera Gomez 2026-09-05 00:28:33 -06:00 committed by Vinod Koul
parent a5b2763df3
commit 4bbfc1d7e5
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/dma/loongson/loongson2-apb-cmc-dma.c
View File

@ -399,8 +399,10 @@ loongson2_cmc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
for_each_sg(sgl, sg, sg_len, i) {
ret = loongson2_cmc_dma_set_xfer_param(lchan, direction, &buswidth, sg_dma_len(sg));
if (ret)
if (ret) {
kfree(desc);
return ERR_PTR(ret);
}
num_items = DIV_ROUND_UP(sg_dma_len(sg), buswidth);
if (num_items >= LOONSON2_CMCDMA_MAX_DATA_ITEMS) {