From patchwork Sun Sep 27 00:39:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Slavin Liu X-Patchwork-Id: 3497 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10]) by mxe881.netcup.net (Postfix) with ESMTPS id 18AFC1C2F8B for ; Sun, 27 Sep 2026 02:40:17 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=seu.edu.cn; spf=pass (sender IP is 172.234.253.10) smtp.mailfrom=linux-sunxi+bounces-26305-noreply=patchwork.local@lists.linux.dev smtp.helo=sea.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.234.253.10 as permitted sender) client-ip=172.234.253.10; envelope-from=linux-sunxi+bounces-26305-noreply=patchwork.local@lists.linux.dev; helo=sea.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id ED4AB2A637 for ; Sun, 27 Sep 2026 00:40:01 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D229828FFF6; Sun, 27 Sep 2026 00:40:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="Brvy0TWM" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-m155101.qiye.163.com (mail-m155101.qiye.163.com [101.71.155.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4AAF25333F for ; Sun, 27 Sep 2026 00:39:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=101.71.155.101 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790469600; cv=none; b=Y5F5TQEW51Mmz7I3Ye6Th+HLcnoW0WQQxUOrSzMGoBTiZvelMapxKl/WWUboOc88LThMZhrfxVR/l0h7avn0jYMhM8o1pKfZVdJS2EjdpxYLU9jt+FyLl+BoNUdwNV1LHrDTuHnlrsGJO+B63JUgx/X9opAtbt2nLUl8L7qK6eg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790469600; c=relaxed/simple; bh=GCzP6euvKpSYuYQThYgcbJ04uTy/NJFMXHRYs7e/a1M=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=WADT/1+LebACT1NYE1pBML9bW1RdKE+BePWCgJPYpCj6SpTieUl5Wy/4k/9sOlZd1sX8lQyQnu4gN7ZAyLx06XGBMZ55j8ZLTyfFCuZ9OGUhf1xb7HruS8BqYefrMA7HDV/zcElyRBpcei/mILhfpj3vJ79RcjT3PVHNDHocDBs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=Brvy0TWM; arc=none smtp.client-ip=101.71.155.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Received: from seu.edu.cn (unknown [223.112.146.162]) by smtp.qiye.163.com (Hmail) with ESMTP id 4f364003f; Sun, 27 Sep 2026 08:39:52 +0800 (GMT+08:00) From: Slavin Liu To: vkoul@kernel.org Cc: Frank.Li@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, bolin.liu@seu.edu.cn Subject: [PATCH 1/2] dmaengine: sun6i: Fix use-after-free in slave sg LLI error cleanup Date: Sun, 27 Sep 2026 08:39:50 +0800 Message-Id: <20260927003951.11210-1-bolin.liu@seu.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-HM-Tid: 0aa0e04dd51403a1kunm4a399e5a199cc7 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlDQhpMVk9LGhgeSkkdSB9NQlYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUhVSkpJVUpPTVVKTUlZV1kWGg8SFR0UWUFZT0tIVUpLSU hOQ0NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=Brvy0TWMlY4NSwnTMHliFyYzDnDuLaujYzQdtIlfTpcArAwP+aDFVpeDSoLCV8fTtJmFYS5BK0SMFRe/s4EnHabAeRUjiMGATmVZ3JtbkVAFRc/YG45+dVd68Yt3PmyMIs4C5bLBhWpwxam39Xte9r9vAoOUvcGwtKIlCGb3IvQ=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=EPZVT0iLAUIySdD3wN4FpEinf/bsqEsqXSgFqjUbfTg=; h=date:mime-version:subject:message-id:from; X-Rspamd-Server: rspamd-worker-8404 X-Spamd-Result: default: False [-0.66 / 15.00]; BAYES_HAM(-5.50)[100.00%]; RBL_SENDERSCORE(2.00)[172.234.253.10:from]; SUSPICIOUS_RECIPS(1.50)[]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; MAILLIST(-0.15)[generic]; MIME_GOOD(-0.10)[text/plain]; BAD_REP_POLICIES(0.10)[]; HAS_LIST_UNSUB(-0.01)[]; PRECEDENCE_BULK(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[seu.edu.cn:email,seu.edu.cn:dkim,sea.lore.kernel.org:rdns,sea.lore.kernel.org:helo]; FROM_HAS_DN(0.00)[]; TAGGED_RCPT(0.00)[]; FREEMAIL_CC(0.00)[kernel.org,gmail.com,sholland.org,vger.kernel.org,lists.infradead.org,lists.linux.dev,seu.edu.cn]; RCVD_COUNT_FIVE(0.00)[5]; R_DKIM_ALLOW(0.00)[seu.edu.cn:s=default]; FROM_NEQ_ENVFROM(0.00)[bolin.liu@seu.edu.cn,linux-sunxi@lists.linux.dev]; DMARC_POLICY_ALLOW(0.00)[seu.edu.cn,none]; RCPT_COUNT_SEVEN(0.00)[10]; DKIM_TRACE(0.00)[seu.edu.cn:+]; TO_DN_NONE(0.00)[]; FORGED_SENDER_MAILLIST(0.00)[]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; RCVD_TLS_LAST(0.00)[]; ARC_ALLOW(0.00)[subspace.kernel.org:s=arc-20240116:i=1]; MIME_TRACE(0.00)[0:+]; TAGGED_FROM(0.00)[bounces-26305-noreply=patchwork.local]; ASN(0.00)[asn:63949, ipnet:172.234.224.0/19, country:SG]; R_SPF_ALLOW(0.00)[+ip4:172.234.253.10:c] X-Rspamd-Queue-Id: 18AFC1C2F8B X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= sun6i_dma_prep_slave_sg() chains one pool-allocated LLI per scatterlist entry. When a later dma_pool_alloc() fails (GFP_NOWAIT, so it does not wait for reclaim, making failure realistic under memory pressure), the err_lli_free path walks the chain to free what was built: the loop body hands the current LLI back to the pool with dma_pool_free(), and the for-loop increment then reads v_lli->p_lli_next and v_lli->v_lli_next from the memory that was just freed and may already have been reallocated. Cache both next fields of the current LLI before freeing it. Fixes: 4fbd804e009a ("dmaengine: sun6i: Fix memory leaks") Assisted-by: LLM Signed-off-by: Slavin Liu --- drivers/dma/sun6i-dma.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c index 7704b016aed8..025a43d0298d 100644 --- a/drivers/dma/sun6i-dma.c +++ b/drivers/dma/sun6i-dma.c @@ -790,9 +790,14 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_slave_sg( return vchan_tx_prep(&vchan->vc, &txd->vd, flags); err_lli_free: - for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli; - p_lli = v_lli->p_lli_next, v_lli = v_lli->v_lli_next) + for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli;) { + dma_addr_t next_p_lli = v_lli->p_lli_next; + struct sun6i_dma_lli *next_v_lli = v_lli->v_lli_next; + dma_pool_free(sdev->pool, v_lli, p_lli); + p_lli = next_p_lli; + v_lli = next_v_lli; + } kfree(txd); return NULL; } From patchwork Sun Sep 27 00:39:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Slavin Liu X-Patchwork-Id: 3496 Return-Path: X-Original-To: noreply@patchwork.local Delivered-To: noreply@patchwork.local Received: from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74]) by mxe881.netcup.net (Postfix) with ESMTPS id 37F531C2F8B for ; Sun, 27 Sep 2026 02:40:02 +0200 (CEST) Authentication-Results: mxe881; dkim=pass header.d=seu.edu.cn; spf=pass (sender IP is 172.232.135.74) smtp.mailfrom=linux-sunxi+bounces-26304-noreply=patchwork.local@lists.linux.dev smtp.helo=sto.lore.kernel.org Received-SPF: pass (mxe881: domain of lists.linux.dev designates 172.232.135.74 as permitted sender) client-ip=172.232.135.74; envelope-from=linux-sunxi+bounces-26304-noreply=patchwork.local@lists.linux.dev; helo=sto.lore.kernel.org; Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sto.lore.kernel.org (Postfix) with ESMTP id 77A35604C28 for ; Sun, 27 Sep 2026 00:40:00 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 788192931C0; Sun, 27 Sep 2026 00:39:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="Qv8ifEVn" X-Original-To: linux-sunxi@lists.linux.dev Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F44B1D5174 for ; Sun, 27 Sep 2026 00:39:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790469599; cv=none; b=Bioid+0JvENP8t3uPEHA0p3bf+bZ2hLKTfdOkKLU9IHUlT+jUs6bm0QEOkku9Kkwoc20h6e8NY+71FRVCsT+5M011woqtK7/rbmgdlDsHYg5jLpahCQeBurghxIuFO19s0/lr+O6P5luHIrmJVwIQ30wgBzm1JN/Tq44q6KOcRs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790469599; c=relaxed/simple; bh=hY6PEDOCypzgDYKp1Pzq02e0IR+XAqV6pzMOQ7GbZ6M=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=L6qoFOp8hFlKAdOxATwFcLSNZk56DygkFAeP2bMG/Aec1h6RBIAGs59vWse5W17bL4Vncp0w9F38BRX682BrpkUPmvaJ4EXX3KEbr8vnl8B5I8HOU9fS1sat9VygaMY1F82pduTbzJxn+Ez+Gy3WVQGpYHk1nFHseu8AhmbtpFE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=Qv8ifEVn; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Received: from seu.edu.cn (unknown [223.112.146.162]) by smtp.qiye.163.com (Hmail) with ESMTP id 4f3640040; Sun, 27 Sep 2026 08:39:53 +0800 (GMT+08:00) From: Slavin Liu To: vkoul@kernel.org Cc: Frank.Li@kernel.org, wens@kernel.org, jernej.skrabec@gmail.com, samuel@sholland.org, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, linux-kernel@vger.kernel.org, bolin.liu@seu.edu.cn Subject: [PATCH 2/2] dmaengine: sun6i: Fix use-after-free in cyclic LLI error cleanup Date: Sun, 27 Sep 2026 08:39:51 +0800 Message-Id: <20260927003951.11210-2-bolin.liu@seu.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260927003951.11210-1-bolin.liu@seu.edu.cn> References: <20260927003951.11210-1-bolin.liu@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-sunxi@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-HM-Tid: 0aa0e04dd8fd03a1kunm4a399e5a199ccb X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlCGBkZVksdQk8ZQkMfQx0eTlYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlJSUhVSkpJVUpPTVVKTUlZV1kWGg8SFR0UWUFZT0tIVUpLSU hOQ0NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=Qv8ifEVncZzTPztmWlYQJWRhMdWhrWKsTxnnyfWqrf7IxnVsut/D1vgdJD3prvWSCbAX74CHj0lqZSMWgcgJOzN15vuzXQYjFFAi2FMStlPZsSF0VDYeoE0VmbkLCU7WNjDcBvhQ3o7GK/cBSIJPxdpzYFGfVV9lrDHtLyJeihc=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=hyzCXCa5mKGjYrQQ4pIYenV4b4psqdzT9oL39eHS+S8=; h=date:mime-version:subject:message-id:from; X-Rspamd-Server: rspamd-worker-8404 X-Spamd-Result: default: False [-0.66 / 15.00]; BAYES_HAM(-5.50)[100.00%]; RBL_SENDERSCORE(2.00)[172.232.135.74:from]; SUSPICIOUS_RECIPS(1.50)[]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; MAILLIST(-0.15)[generic]; BAD_REP_POLICIES(0.10)[]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; DKIM_TRACE(0.00)[seu.edu.cn:+]; RCPT_COUNT_SEVEN(0.00)[10]; TO_DN_NONE(0.00)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[sto.lore.kernel.org:rdns,sto.lore.kernel.org:helo,seu.edu.cn:email,seu.edu.cn:dkim]; TAGGED_RCPT(0.00)[]; FREEMAIL_CC(0.00)[kernel.org,gmail.com,sholland.org,vger.kernel.org,lists.infradead.org,lists.linux.dev,seu.edu.cn]; R_SPF_ALLOW(0.00)[+ip4:172.232.135.74]; PRECEDENCE_BULK(0.00)[]; FROM_HAS_DN(0.00)[]; R_DKIM_ALLOW(0.00)[seu.edu.cn:s=default]; RCVD_TLS_LAST(0.00)[]; MIME_TRACE(0.00)[0:+]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; DMARC_POLICY_ALLOW(0.00)[seu.edu.cn,none]; ASN(0.00)[asn:63949, ipnet:172.232.128.0/19, country:SG]; ARC_ALLOW(0.00)[subspace.kernel.org:s=arc-20240116:i=1]; TAGGED_FROM(0.00)[bounces-26304-noreply=patchwork.local]; FORGED_SENDER_MAILLIST(0.00)[]; FROM_NEQ_ENVFROM(0.00)[bolin.liu@seu.edu.cn,linux-sunxi@lists.linux.dev]; RCVD_COUNT_FIVE(0.00)[5] X-Rspamd-Queue-Id: 37F531C2F8B X-MORS-Enabled: yes X-MORS-DOMAIN: patchwork.local X-MORS-HOSTING: hosting172546 X-MORS-USER: hosting172546 X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= sun6i_dma_prep_dma_cyclic() allocates one pool-allocated LLI per period (audio drivers routinely use several periods). When a later dma_pool_alloc() fails, the err_lli_free path frees each chained LLI with dma_pool_free() in the loop body while the for-loop increment reads v_lli->p_lli_next and v_lli->v_lli_next from the LLI that was just returned to the pool and may already have been handed out again. Cache both next fields of the current LLI before freeing it. Same pattern as fixed in the slave sg path in the previous patch. Fixes: a90e173f3faf ("dmaengine: sun6i: Add cyclic capability") Assisted-by: LLM Signed-off-by: Slavin Liu --- drivers/dma/sun6i-dma.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c index 025a43d0298d..4d6ee2fbd682 100644 --- a/drivers/dma/sun6i-dma.c +++ b/drivers/dma/sun6i-dma.c @@ -876,9 +876,14 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_cyclic( return vchan_tx_prep(&vchan->vc, &txd->vd, flags); err_lli_free: - for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli; - p_lli = v_lli->p_lli_next, v_lli = v_lli->v_lli_next) + for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli;) { + dma_addr_t next_p_lli = v_lli->p_lli_next; + struct sun6i_dma_lli *next_v_lli = v_lli->v_lli_next; + dma_pool_free(sdev->pool, v_lli, p_lli); + p_lli = next_p_lli; + v_lli = next_v_lli; + } kfree(txd); return NULL; }