diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-12-14 14:56:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-01-17 14:05:35 +0100 |
| commit | b77e0283efdc2c79d392cf8d7ae9cd5142427199 (patch) | |
| tree | 01cb6bbd8392de005b8ec7dc4861e0b506357867 /drivers/dma | |
| parent | f6dd8c259ab82ca3e44a22542202e061cb23978c (diff) | |
| download | linux-b77e0283efdc2c79d392cf8d7ae9cd5142427199.tar.gz linux-b77e0283efdc2c79d392cf8d7ae9cd5142427199.tar.bz2 linux-b77e0283efdc2c79d392cf8d7ae9cd5142427199.zip | |
dmaengine: dw-edma: Fix use after free in dw_edma_alloc_chunk()
commit 595a334148449bd1d27cf5d6fcb3b0d718cb1b9f upstream.
If the dw_edma_alloc_burst() function fails then we free "chunk" but
it's still on the "desc->chunk->list" list so it will lead to a use
after free. Also the "->chunks_alloc" count is incremented when it
shouldn't be.
In current kernels small allocations are guaranteed to succeed and
dw_edma_alloc_burst() can't fail so this will not actually affect
runtime.
Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
Link: https://lore.kernel.org/r/X9dTBFrUPEvvW7qc@mwanda
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/dma')
| -rw-r--r-- | drivers/dma/dw-edma/dw-edma-core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c index 7f9a86c3c58f..31577316f80b 100644 --- a/drivers/dma/dw-edma/dw-edma-core.c +++ b/drivers/dma/dw-edma/dw-edma-core.c @@ -85,12 +85,12 @@ static struct dw_edma_chunk *dw_edma_alloc_chunk(struct dw_edma_desc *desc) if (desc->chunk) { /* Create and add new element into the linked list */ - desc->chunks_alloc++; - list_add_tail(&chunk->list, &desc->chunk->list); if (!dw_edma_alloc_burst(chunk)) { kfree(chunk); return NULL; } + desc->chunks_alloc++; + list_add_tail(&chunk->list, &desc->chunk->list); } else { /* List head */ chunk->burst = NULL; |