diff options
| author | Miaoqian Lin <linmq006@gmail.com> | 2025-10-29 15:34:19 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-06 18:44:01 +0300 |
| commit | 694ab1f6f16cb69f7c5ef2452b22ba7b00a3c7c7 (patch) | |
| tree | 5656d0c7c6e2b4f48c1613e512d31ac5f5fae86e /drivers/dma | |
| parent | adef147a8d8c3d767abf88ad2c381ffab2993086 (diff) | |
| download | linux-694ab1f6f16cb69f7c5ef2452b22ba7b00a3c7c7.tar.xz | |
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
commit 3f747004bbd641131d9396d87b5d2d3d1e182728 upstream.
Fix a memory leak in gpi_peripheral_config() where the original memory
pointed to by gchan->config could be lost if krealloc() fails.
The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the
reference to the original memory
4. The original memory becomes unreachable and cannot be freed
Fix this by using a temporary variable to hold the krealloc() result
and only updating gchan->config when the allocation succeeds.
Found via static analysis and code review.
Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/dma')
| -rw-r--r-- | drivers/dma/qcom/gpi.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c index db6d0dc308d2..846b532d77a5 100644 --- a/drivers/dma/qcom/gpi.c +++ b/drivers/dma/qcom/gpi.c @@ -1621,14 +1621,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan); + void *new_config; if (!config->peripheral_config) return -EINVAL; - gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); - if (!gchan->config) + new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT); + if (!new_config) return -ENOMEM; + gchan->config = new_config; memcpy(gchan->config, config->peripheral_config, config->peripheral_size); return 0; |