Commit bb84b087 authored Oct 16, 2024 by Olivier Dautricourt Committed by Jinjiang Tu Oct 16, 2024

dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor

mainline inclusion
from mainline-v6.11-rc1
commit 54e4ada1a4206f878e345ae01cf37347d803d1b1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARVBS
CVE: CVE-2024-46716

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=54e4ada1a4206f878e345ae01cf37347d803d1b1



--------------------------------

Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
of msgdma_free_descriptor. In consequence replace list_add_tail with
list_move_tail in msgdma_free_descriptor.

This fixes the path:
   msgdma_free_chan_resources -> msgdma_free_descriptors ->
   msgdma_free_desc_list -> msgdma_free_descriptor

which does not correctly free the descriptors as first nodes were not
removed from the list.

Signed-off-by: Olivier Dautricourt <olivierdautricourt@gmail.com>
Tested-by: Olivier Dautricourt <olivierdautricourt@gmail.com>
Link: https://lore.kernel.org/r/20240608213216.25087-3-olivierdautricourt@gmail.com


Signed-off-by: Vinod Koul <vkoul@kernel.org>

Conflicts:
	drivers/dma/altera-msgdma.c
[Context conflicts due to a34da7ef ("dmaengine: altera-msgdma:
Correctly handle descriptor callbacks") is not merged.]
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>

parent 0f104c99

drivers/dma/altera-msgdma.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -232,7 +232,7 @@ static void msgdma_free_descriptor(struct msgdma_device *mdev,
		struct msgdma_sw_desc child, next;

		mdev->desc_free_cnt++;
		list_add_tail(&desc->node, &mdev->free_list);
		list_move_tail(&desc->node, &mdev->free_list);
		list_for_each_entry_safe(child, next, &desc->tx_list, node) {
		mdev->desc_free_cnt++;
		list_move_tail(&child->node, &mdev->free_list);
		@@ -587,8 +587,6 @@ static void msgdma_chan_desc_cleanup(struct msgdma_device *mdev)
		dma_async_tx_callback callback;
		void *callback_param;

		list_del(&desc->node);

		callback = desc->async_tx.callback;
		callback_param = desc->async_tx.callback_param;
		if (callback) {