dmaengine: dma-jz4780: free the correct descriptor on prep error - #19
Open
wormuz wants to merge 1 commit into
Open
dmaengine: dma-jz4780: free the correct descriptor on prep error#19wormuz wants to merge 1 commit into
wormuz wants to merge 1 commit into
Conversation
The error paths of jz4780_dma_prep_slave_sg() and jz4780_dma_prep_dma_cyclic() free jzchan->desc, which is the descriptor of the transfer currently running on the channel, not the descriptor that was just allocated and failed to populate. If a transfer is in flight when a prep call fails (for example an unaligned scatterlist entry), the running descriptor is returned to the pool while the hardware is still using it: the DMA controller keeps reading freed pool memory, and the next allocation hands the same memory to another transfer. The newly allocated descriptor is leaked at the same time. Free the local desc that this function allocated. Signed-off-by: wormuz <3341798+wormuz@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The error paths of jz4780_dma_prep_slave_sg() and jz4780_dma_prep_dma_cyclic() free jzchan->desc (the descriptor of the transfer currently running on the channel) instead of the descriptor that was just allocated and failed to populate.
If a transfer is in flight when a prep call fails, the running descriptor is returned to the pool while the hardware is still using it, and the newly allocated descriptor is leaked.
Found on an RG350P handheld (JZ4770).