From 4bbfc1d7e56134336dd1f792f51ee88a600a27ad Mon Sep 17 00:00:00 2001 From: Diego Fernando Mancera Gomez Date: Sat, 5 Sep 2026 00:28:33 -0600 Subject: [PATCH] dmaengine: loongson2-apb-cmc: fix descriptor leak in prep_slave_sg() loongson2_cmc_dma_prep_slave_sg() allocates the descriptor with kzalloc_flex() before iterating over the scatterlist. If loongson2_cmc_dma_set_xfer_param() fails inside the loop, the function returns ERR_PTR(ret) without freeing the descriptor. At this point the descriptor has not been handed to vchan_tx_prep() yet, so nothing else will ever free it, leaking it on every failed ->device_prep_slave_sg() call (e.g. an unsupported transfer direction or bus width). The neighbouring error path for the num_items check already frees the descriptor before returning; do the same on the set_xfer_param() failure path. Fixes: 1c0028e725f1 ("dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller") Link: https://lore.kernel.org/all/20260818094957.7D2221F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Signed-off-by: Diego Fernando Mancera Gomez Co-authored-by: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_012bUV3WshMSfTq61n1cgh1i Reviewed-by: Frank Li Link: https://patch.msgid.link/20260905062833.272484-1-diegomancera.dev@gmail.com Signed-off-by: Vinod Koul --- drivers/dma/loongson/loongson2-apb-cmc-dma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/loongson/loongson2-apb-cmc-dma.c b/drivers/dma/loongson/loongson2-apb-cmc-dma.c index bc336947e31a..e440430bed80 100644 --- a/drivers/dma/loongson/loongson2-apb-cmc-dma.c +++ b/drivers/dma/loongson/loongson2-apb-cmc-dma.c @@ -399,8 +399,10 @@ loongson2_cmc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl, for_each_sg(sgl, sg, sg_len, i) { ret = loongson2_cmc_dma_set_xfer_param(lchan, direction, &buswidth, sg_dma_len(sg)); - if (ret) + if (ret) { + kfree(desc); return ERR_PTR(ret); + } num_items = DIV_ROUND_UP(sg_dma_len(sg), buswidth); if (num_items >= LOONSON2_CMCDMA_MAX_DATA_ITEMS) {