Re: [PATCH 5.10 037/161] dmaengine: at_hdmac: fix device leak on of_dma_xlate()

Ben Hutchings
2026-02-05T14:57:18Z

[-- Attachment #1: Type: text/plain, Size: 2250 bytes --]

On Wed, 2026-02-04 at 15:38 +0100, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Johan Hovold <johan@kernel.org>
>
> commit b9074b2d7a230b6e28caa23165e9d8bc0677d333 upstream.
>
> Make sure to drop the reference taken when looking up the DMA platform
> device during of_dma_xlate() when releasing channel resources.
>
> Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing
> put_device() call in at_dma_xlate()") fixed the leak in a couple of
> error paths but the reference is still leaking on successful allocation.
>
> Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
> Fixes: 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()")
> Cc: stable@vger.kernel.org # 3.10: 3832b78b3ec2
> Cc: Yu Kuai <yukuai3@huawei.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> Link: https://patch.msgid.link/20251117161258.10679-2-johan@kernel.org
> Signed-off-by: Vinod Koul <vkoul@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/dma/at_hdmac.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> --- a/drivers/dma/at_hdmac.c
> +++ b/drivers/dma/at_hdmac.c
> @@ -1320,6 +1320,7 @@ static int atc_config(struct dma_chan *c
> struct dma_slave_config *sconfig)
> {
> struct at_dma_chan *atchan = to_at_dma_chan(chan);
> + struct at_dma_slave *atslave;
>
> dev_vdbg(chan2dev(chan), "%s\n", __func__);
>

This hunk is being applied to the wrong function. It should also be
applied to atc_free_chan_resources() (but doesn't apply cleanly).

Ben.

> @@ -1579,8 +1580,12 @@ static void atc_free_chan_resources(stru
> /*
> * Free atslave allocated in at_dma_xlate()
> */
> - kfree(chan->private);
> - chan->private = NULL;
> + atslave = chan->private;
> + if (atslave) {
> + put_device(atslave->dma_dev);
> + kfree(atslave);
> + chan->private = NULL;
> + }
>
> dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
> }
>
>

--
Ben Hutchings
Horngren's Observation:
Among economists, the real world is often a special case.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]