Commit 595a3341 authored Dec 14, 2020 by Dan Carpenter Committed by Vinod Koul Dec 29, 2020

dmaengine: dw-edma: Fix use after free in dw_edma_alloc_chunk()



If the dw_edma_alloc_burst() function fails then we free "chunk" but
it's still on the "desc->chunk->list" list so it will lead to a use
after free.  Also the "->chunks_alloc" count is incremented when it
shouldn't be.

In current kernels small allocations are guaranteed to succeed and
dw_edma_alloc_burst() can't fail so this will not actually affect
runtime.

Fixes: e63d79d1 ("dmaengine: Add Synopsys eDMA IP core driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
Link: https://lore.kernel.org/r/X9dTBFrUPEvvW7qc@mwanda


Signed-off-by: Vinod Koul <vkoul@kernel.org>

parent d645148c

drivers/dma/dw-edma/dw-edma-core.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -86,12 +86,12 @@ static struct dw_edma_chunk dw_edma_alloc_chunk(struct dw_edma_desc desc)

		if (desc->chunk) {
		/* Create and add new element into the linked list */
		desc->chunks_alloc++;
		list_add_tail(&chunk->list, &desc->chunk->list);
		if (!dw_edma_alloc_burst(chunk)) {
		kfree(chunk);
		return NULL;
		}
		desc->chunks_alloc++;
		list_add_tail(&chunk->list, &desc->chunk->list);
		} else {
		/* List head */
		chunk->burst = NULL;