From 2c4868c74b7f177a1a505eb62da4f9200a2f1ea5 Mon Sep 17 00:00:00 2001 From: wormuz <3341798+wormuz@users.noreply.github.com> Date: Sat, 15 Aug 2026 18:27:44 +0300 Subject: [PATCH] dmaengine: dma-jz4780: free the correct descriptor on prep error The error paths of jz4780_dma_prep_slave_sg() and jz4780_dma_prep_dma_cyclic() free jzchan->desc, which is the descriptor of the transfer currently running on the channel, not the descriptor that was just allocated and failed to populate. If a transfer is in flight when a prep call fails (for example an unaligned scatterlist entry), the running descriptor is returned to the pool while the hardware is still using it: the DMA controller keeps reading freed pool memory, and the next allocation hands the same memory to another transfer. The newly allocated descriptor is leaked at the same time. Free the local desc that this function allocated. Signed-off-by: wormuz <3341798+wormuz@users.noreply.github.com> --- drivers/dma/dma-jz4780.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c index 100057603fd4e1..b078e5807651bf 100644 --- a/drivers/dma/dma-jz4780.c +++ b/drivers/dma/dma-jz4780.c @@ -379,7 +379,7 @@ static struct dma_async_tx_descriptor *jz4780_dma_prep_slave_sg( sg_dma_len(&sgl[i]), direction); if (err < 0) { - jz4780_dma_desc_free(&jzchan->desc->vdesc); + jz4780_dma_desc_free(&desc->vdesc); return NULL; } @@ -426,7 +426,7 @@ static struct dma_async_tx_descriptor *jz4780_dma_prep_dma_cyclic( err = jz4780_dma_setup_hwdesc(jzchan, &desc->desc[i], buf_addr, period_len, direction); if (err < 0) { - jz4780_dma_desc_free(&jzchan->desc->vdesc); + jz4780_dma_desc_free(&desc->vdesc); return NULL; }