Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752420AbdHAUKF (ORCPT ); Tue, 1 Aug 2017 16:10:05 -0400 Received: from mail-wr0-f194.google.com ([209.85.128.194]:38778 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752310AbdHAUKD (ORCPT ); Tue, 1 Aug 2017 16:10:03 -0400 From: Antonio Borneo To: dmaengine@vger.kernel.org, Vinod Koul , Dan Williams Cc: Antonio Borneo , linux-kernel@vger.kernel.org, John Stultz , Zhangfei Gao Subject: [PATCH v2 2/3] dmaengine: k3dma: fix double free of descriptor Date: Tue, 1 Aug 2017 22:09:26 +0200 Message-Id: <20170801200928.24661-3-borneo.antonio@gmail.com> X-Mailer: git-send-email 2.13.3 In-Reply-To: <20170801200928.24661-1-borneo.antonio@gmail.com> References: <20170801200928.24661-1-borneo.antonio@gmail.com> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1439 Lines: 46 Commit 36387a2b1f62b5c087c5fe6f0f7b23b94f722ad7 ("k3dma: Fix memory handling in preparation for cyclic mode") adds code to free the descriptor in ds_done. In cyclic mode, ds_done is never used and it's always NULL, so the added code is not executed. In non-cyclic mode, ds_done is used as a flag: when not NULL it signals that the descriptor has been consumed. No need to free it because it would be free by vchan_complete(). The fix takes back the code changed by the commit above: - remove the free on the descriptor; - initialize ds_done to NULL for the next run. Signed-off-by: Antonio Borneo --- To: dmaengine@vger.kernel.org To: Vinod Koul To: Dan Williams Cc: linux-kernel@vger.kernel.org Cc: John Stultz Cc: Zhangfei Gao --- drivers/dma/k3dma.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/dma/k3dma.c b/drivers/dma/k3dma.c index c00eb12..b769623 100644 --- a/drivers/dma/k3dma.c +++ b/drivers/dma/k3dma.c @@ -724,11 +724,7 @@ static int k3_dma_terminate_all(struct dma_chan *chan) k3_dma_free_desc(&p->ds_run->vd); p->ds_run = NULL; } - if (p->ds_done) { - k3_dma_free_desc(&p->ds_done->vd); - p->ds_done = NULL; - } - + p->ds_done = NULL; } spin_unlock_irqrestore(&c->vc.lock, flags); vchan_dma_desc_free_list(&c->vc, &head); -- 1.9.1