linux-kernel - Re: [PATCH] dmaengine: Loongson1: Fix memory leak in ls1x_dma_prep_dma

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJhJPsWaa+PN--YV3TXwquW1qLBF-Q=0a7z4kX6pLDyU-JKQ1Q@mail.gmail.com>
Date: Sun, 16 Nov 2025 11:09:01 +0800
From: Keguang Zhang <keguang.zhang@...il.com>
To: Zilin Guan <zilin@....edu.cn>
Cc: vkoul@...nel.org, linux-mips@...r.kernel.org, dmaengine@...r.kernel.org, 
	linux-kernel@...r.kernel.org, jianhao.xu@....edu.cn
Subject: Re: [PATCH] dmaengine: Loongson1: Fix memory leak in ls1x_dma_prep_dma_cyclic()

On Mon, Nov 10, 2025 at 4:52 PM Zilin Guan <zilin@....edu.cn> wrote:
>
> In ls1x_dma_prep_dma_cyclic(), a descriptor is allocated with
> ls1x_dma_alloc_desc(). If the subsequent allocation for the scatterlist
> fails, the function returns NULL without freeing the descriptor, which
> causes a memory leak.
>
> Fix this by calling ls1x_dma_free_desc() in the error path to ensure
> the descriptor is freed.
>
> Fixes: e06c432312148 ("dmaengine: Loongson1: Add Loongson-1 APB DMA driver")
> Signed-off-by: Zilin Guan <zilin@....edu.cn>
> ---
>  drivers/dma/loongson1-apb-dma.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/loongson1-apb-dma.c b/drivers/dma/loongson1-apb-dma.c
> index 255fe7eca212..5ee829bc5c77 100644
> --- a/drivers/dma/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson1-apb-dma.c
> @@ -336,8 +336,10 @@ ls1x_dma_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t buf_addr,
>         /* allocate the scatterlist */
>         sg_len = buf_len / period_len;
>         sgl = kmalloc_array(sg_len, sizeof(*sgl), GFP_NOWAIT);
> -       if (!sgl)
> +       if (!sgl) {
> +               ls1x_dma_free_desc(&desc->vd);
>                 return NULL;
> +       }
>
>         sg_init_table(sgl, sg_len);
>         for (i = 0; i < sg_len; ++i) {
> --
> 2.34.1
>
Reviewed-by: Keguang Zhang <keguang.zhang@...il.com>

-- 
Best regards,

Keguang Zhang