Commit 3f747004 authored by Miaoqian Lin's avatar Miaoqian Lin Committed by Vinod Koul
Browse files

dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() 



Fix a memory leak in gpi_peripheral_config() where the original memory
pointed to by gchan->config could be lost if krealloc() fails.

The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the
   reference to the original memory
4. The original memory becomes unreachable and cannot be freed

Fix this by using a temporary variable to hold the krealloc() result
and only updating gchan->config when the allocation succeeds.

Found via static analysis and code review.

Fixes: 5d0c3533 ("dmaengine: qcom: Add GPI dma driver")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMiaoqian Lin <linmq006@gmail.com>
Reviewed-by: default avatarBjorn Andersson <andersson@kernel.org>
Link: https://patch.msgid.link/20251029123421.91973-1-linmq006@gmail.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent 747213b0

drivers/dma/qcom/gpi.c

+4 −2
Original line number Diff line number Diff line
@@ -1605,14 +1605,16 @@ static int 
gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)

{

	struct gchan *gchan = to_gchan(chan);

	void *new_config;



	if (!config->peripheral_config)

		return -EINVAL;



	gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);

	if (!gchan->config)

	new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);

	if (!new_config)

		return -ENOMEM;



	gchan->config = new_config;

	memcpy(gchan->config, config->peripheral_config, config->peripheral_size);



	return 0;