Re: [PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NULL Pointer Dereference in atdma_desc_free during descriptor preparation error paths.
--

--- Patch [1]: [PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg ---
commit 59e07e1618be88a67e6deaa08218ec2ae653a007
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

This commit fixes a memory leak in the default switch case of the slave
scatter-gather preparation function. It adds a missing free for the
allocated descriptor before returning on an invalid direction.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..7763a94d3f998 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
> @@ -1381,6 +1381,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
>  		}
>  		break;
>  	default:
> +		kfree(desc);
>  		return NULL;
>  	}

[Severity: High]
This is a pre-existing issue, but while reviewing this error handling I noticed
a potential NULL pointer dereference in the other error paths of this function.

If dma_pool_alloc() fails or an SG list has a zero-length entry, the code
jumps to the error path:

err_desc_get:
        dev_err(chan2dev(chan), "not enough descriptors available\n");
err:
        atdma_desc_free(&desc->vd);
        return NULL;

Inside atdma_desc_free(), it immediately evaluates the device from the channel:

static void atdma_desc_free(struct virt_dma_desc *vd)
{
        struct at_dma *atdma = to_at_dma(vd->tx.chan->device);
        ...
}

Since desc was just allocated with kzalloc_flex() which zeroes memory, and
vd->tx.chan is not initialized until vchan_tx_prep() is called at the end of
atc_prep_slave_sg(), won't vd->tx.chan still be NULL during this cleanup?

Does this code trigger a panic when attempting to dereference the NULL channel
pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050402.272606-1-rosenp@gmail.com?part=1