diff options
| author | Rosen Penev <rosenp@gmail.com> | 2026-07-18 16:52:27 -0700 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-09-03 19:22:36 +0530 |
| commit | d805aa5b6088b193debabaa80cc0991bfa2bd057 (patch) | |
| tree | 53d4f1bc0260b3045a8dbb6552f2347bd93568a3 | |
| parent | 62c267ce97444f8a381f2bb3cd5d534eb362c540 (diff) | |
| download | linux-next-d805aa5b6088b193debabaa80cc0991bfa2bd057.tar.gz linux-next-d805aa5b6088b193debabaa80cc0991bfa2bd057.zip | |
dmaengine: fsl_raid: avoid free_q underflow in free_chan_resources
fsl_re_free_chan_resources() loops alloc_count times calling
list_first_entry() on free_q without checking whether the list still
has entries. If descriptors remain un-acked or pending in submit_q /
active_q / ack_q when the channel resources are freed, free_q becomes
smaller than alloc_count and list_first_entry() returns the list head,
causing list_del() to corrupt the list head and dereference a bogus
pointer.
Walk free_q with list_for_each_entry_safe() until it is empty,
decrementing alloc_count per freed descriptor, instead of relying on
the alloc_count count.
Fixes: ad80da658bbc ("dmaengine: Driver support for FSL RaidEngine device.")
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260718235227.385108-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
| -rw-r--r-- | drivers/dma/fsl_raid.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c index bfaef6245695..e698c40b2ebc 100644 --- a/drivers/dma/fsl_raid.c +++ b/drivers/dma/fsl_raid.c @@ -614,18 +614,15 @@ static int fsl_re_alloc_chan_resources(struct dma_chan *chan) static void fsl_re_free_chan_resources(struct dma_chan *chan) { struct fsl_re_chan *re_chan; - struct fsl_re_desc *desc; + struct fsl_re_desc *desc, *_desc; re_chan = container_of(chan, struct fsl_re_chan, chan); - while (re_chan->alloc_count--) { - desc = list_first_entry(&re_chan->free_q, - struct fsl_re_desc, - node); - + list_for_each_entry_safe(desc, _desc, &re_chan->free_q, node) { list_del(&desc->node); dma_pool_free(re_chan->re_dev->cf_desc_pool, desc->cf_addr, desc->cf_paddr); kfree(desc); + re_chan->alloc_count--; } if (!list_empty(&re_chan->free_q)) |