Re: [PATCH v3] dmaengine: sun6i-dma: Fix use-after-free in error handling paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak in `sun6i_dma_terminate_all` for active non-cyclic descriptors.
--

commit 81994b3beae8e2aae413048bdddddd1fbb74bec0
Author: Hongling Zeng <zenghongling@kylinos.cn>

dmaengine: sun6i-dma: Fix use-after-free in error handling paths
    
This patch fixes a use-after-free during the error handling path of
sun6i_dma_prep_slave_sg and sun6i_dma_prep_dma_cyclic. It replaces an
unsafe manual loop traversal with a call to sun6i_dma_free_desc(),
which safely stores the next pointers before freeing the current LLI.

> diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
> index a9a254dbf8cb9..7a79f346250a5 100644
> --- a/drivers/dma/sun6i-dma.c
> +++ b/drivers/dma/sun6i-dma.c

[ ... ]

While looking at this driver's descriptor cleanup, I noticed a separate
issue in sun6i_dma_terminate_all():

drivers/dma/sun6i-dma.c:sun6i_dma_terminate_all()
	if (vchan->cyclic) {
		vchan->cyclic = false;
		if (pchan && pchan->desc) {
			struct virt_dma_desc *vd = &pchan->desc->vd;
			struct virt_dma_chan *vc = &vchan->vc;

			list_add_tail(&vd->node, &vc->desc_completed);
		}
	}

	vchan_get_all_descriptors(&vchan->vc, &head);

	if (pchan) {
		writel(DMA_CHAN_ENABLE_STOP, pchan->base + DMA_CHAN_ENABLE);
		writel(DMA_CHAN_PAUSE_RESUME, pchan->base + DMA_CHAN_PAUSE);

		vchan->phy = NULL;
		pchan->vchan = NULL;
		pchan->desc = NULL;
                ^^^^^^^^^^^^^^^^^^
[Severity: High]
This is a pre-existing issue, but does this leak the active non-cyclic
descriptor?

When a non-cyclic transfer is aborted, pchan->desc is not added to the
desc_completed list (unlike cyclic transfers). Because it was already
removed from the desc_issued list during sun6i_dma_start_desc(),
setting pchan->desc to NULL here seems to permanently orphan the
descriptor and its associated LLIs, leading to a memory leak.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616023138.15904-1-zenghongling@kylinos.cn?part=1