Commit d64f6d4a authored by Hui Wang's avatar Hui Wang Committed by Tirui Yin
Browse files

dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init 

stable inclusion
from stable-v4.19.272
commit 80ee99e52936b2c04cc37b17a14b2ae2f9d282ac
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWT
CVE: CVE-2022-49746

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=80ee99e52936b2c04cc37b17a14b2ae2f9d282ac



--------------------------------

[ Upstream commit 1417f59a ]

If the function sdma_load_context() fails, the sdma_desc will be
freed, but the allocated desc->bd is forgot to be freed.

We already met the sdma_load_context() failure case and the log as
below:
[ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready
...

In this case, the desc->bd will not be freed without this change.

Signed-off-by: default avatarHui Wang <hui.wang@canonical.com>
Reviewed-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
Link: https://lore.kernel.org/r/20221130090800.102035-1-hui.wang@canonical.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarTirui Yin <yintirui@huawei.com>
Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
parent 3191c9e4

drivers/dma/imx-sdma.c

+3 −1
Original line number Diff line number Diff line
@@ -1353,10 +1353,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac, 
		sdma_config_ownership(sdmac, false, true, false);



	if (sdma_load_context(sdmac))

		goto err_desc_out;

		goto err_bd_out;



	return desc;



err_bd_out:

	sdma_free_bd(desc);

err_desc_out:

	kfree(desc);

err_out: