[PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

[PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

[Rosen Penev]

The default case in the direction switch returns NULL without freeing
the descriptor allocated earlier via kzalloc_flex(). Add the missing
kfree(desc) before returning.

Fixes: 808347f6a317 ("dmaengine: at_hdmac: add DMA slave transfers")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/at_hdmac.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index f9c336630fa2..c06f70dbc4c5 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -1381,6 +1381,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 		}
 		break;
 	default:
+		kfree(desc);
 		return NULL;
 	}
 
-- 
2.55.0

Re: [PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NULL Pointer Dereference in atdma_desc_free during descriptor preparation error paths.
--

--- Patch [1]: [PATCH] dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg ---
commit 59e07e1618be88a67e6deaa08218ec2ae653a007
Author: Rosen Penev <rosenp@gmail.com>

dmaengine: at_hdmac: fix memory leak in atc_prep_slave_sg

This commit fixes a memory leak in the default switch case of the slave
scatter-gather preparation function. It adds a missing free for the
allocated descriptor before returning on an invalid direction.

> diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
> index e5b30a57c477a..7763a94d3f998 100644
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
> @@ -1381,6 +1381,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
>  		}
>  		break;
>  	default:
> +		kfree(desc);
>  		return NULL;
>  	}

[Severity: High]
This is a pre-existing issue, but while reviewing this error handling I noticed
a potential NULL pointer dereference in the other error paths of this function.

If dma_pool_alloc() fails or an SG list has a zero-length entry, the code
jumps to the error path:

err_desc_get:
        dev_err(chan2dev(chan), "not enough descriptors available\n");
err:
        atdma_desc_free(&desc->vd);
        return NULL;

Inside atdma_desc_free(), it immediately evaluates the device from the channel:

static void atdma_desc_free(struct virt_dma_desc *vd)
{
        struct at_dma *atdma = to_at_dma(vd->tx.chan->device);
        ...
}

Since desc was just allocated with kzalloc_flex() which zeroes memory, and
vd->tx.chan is not initialized until vchan_tx_prep() is called at the end of
atc_prep_slave_sg(), won't vd->tx.chan still be NULL during this cleanup?

Does this code trigger a panic when attempting to dereference the NULL channel
pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723050402.272606-1-rosenp@gmail.com?part=1