diff options
| author | Logan Gunthorpe <logang@deltatee.com> | 2026-09-02 00:21:43 -0600 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-10-05 15:44:11 +0200 |
| commit | bdfd76514bd11301f4e67d150485ab696c26d83d (patch) | |
| tree | 3e2e88c0df3ac35814a9469a08d4af596c803a80 /tools/lib/python/kdoc | |
| parent | f9587f7906ffca0d6bbee01a887079274adf3269 (diff) | |
dmaengine: switchtec-dma: fix double-free in switchtec_dma_free_desc()
switchtec_dma_free_desc() frees swdma_chan->hw_sq, hw_cq, and every
desc_ring[] entry without clearing the pointers afterward. If
switchtec_dma_alloc_chan_resources() fails partway through and calls
it during unwind, then a later retry of alloc_chan_resources() fails
in switchtec_dma_alloc_desc() before reallocating one of those
pointers, its own failure path calls switchtec_dma_free_desc() again
and frees the same, already-freed pointers a second time.
NULL out each pointer as it's freed so a subsequent call is a no-op
for anything already released.
Fixes: 30eba9df76ad ("dmaengine: switchtec-dma: Implement hardware initialization and cleanup")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20260902062153.31048-2-logang@deltatee.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions
