dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

[PATCH] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

Posted by Miaoqian Lin 3 months, 1 week ago

Fix a memory leak in gpi_peripheral_config() where the original memory
pointed to by gchan->config could be lost if krealloc() fails.

The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the
   reference to the original memory
4. The original memory becomes unreachable and cannot be freed

Fix this by using a temporary variable to hold the krealloc() result
and only updating gchan->config when the allocation succeeds.

Found via static analysis and code review.

Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/dma/qcom/gpi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
index 8e87738086b2..8908b7c71900 100644
--- a/drivers/dma/qcom/gpi.c
+++ b/drivers/dma/qcom/gpi.c
@@ -1605,14 +1605,16 @@ static int
 gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
 {
 	struct gchan *gchan = to_gchan(chan);
+	void *new_config;
 
 	if (!config->peripheral_config)
 		return -EINVAL;
 
-	gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
-	if (!gchan->config)
+	new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
+	if (!new_config)
 		return -ENOMEM;
 
+	gchan->config = new_config;
 	memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
 
 	return 0;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

Posted by Vinod Koul 1 month, 2 weeks ago

On Wed, 29 Oct 2025 20:34:19 +0800, Miaoqian Lin wrote:
> Fix a memory leak in gpi_peripheral_config() where the original memory
> pointed to by gchan->config could be lost if krealloc() fails.
> 
> The issue occurs when:
> 1. gchan->config points to previously allocated memory
> 2. krealloc() fails and returns NULL
> 3. The function directly assigns NULL to gchan->config, losing the
>    reference to the original memory
> 4. The original memory becomes unreachable and cannot be freed
> 
> [...]

Applied, thanks!

[1/1] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()
      commit: 2387beefdb3284298e98369bb886584e3abae4ed

Best regards,
-- 
~Vinod

Re: [PATCH] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

Posted by Markus Elfring 3 months, 1 week ago

…
> +++ b/drivers/dma/qcom/gpi.c
> @@ -1605,14 +1605,16 @@ static int
>  gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
>  {
…
> +	new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
> +	if (!new_config)
>  		return -ENOMEM;
>  
> +	gchan->config = new_config;
>  	memcpy(gchan->config, config->peripheral_config, config->peripheral_size);

How do you think about to apply the following source code variant?

	gchan->config = memcpy(new_config, config->peripheral_config, config->peripheral_size);


Regards,
Markus

Re: [PATCH] dma: qcom: gpi: Fix memory leak in gpi_peripheral_config()

Posted by Bjorn Andersson 3 months, 1 week ago

On Wed, Oct 29, 2025 at 08:34:19PM +0800, Miaoqian Lin wrote:
> Fix a memory leak in gpi_peripheral_config() where the original memory
> pointed to by gchan->config could be lost if krealloc() fails.
> 
> The issue occurs when:
> 1. gchan->config points to previously allocated memory
> 2. krealloc() fails and returns NULL
> 3. The function directly assigns NULL to gchan->config, losing the
>    reference to the original memory
> 4. The original memory becomes unreachable and cannot be freed
> 
> Fix this by using a temporary variable to hold the krealloc() result
> and only updating gchan->config when the allocation succeeds.
> 
> Found via static analysis and code review.
> 
> Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>

Reviewed-by: Bjorn Andersson <andersson@kernel.org>

Regards,
Bjorn

> ---
>  drivers/dma/qcom/gpi.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
> index 8e87738086b2..8908b7c71900 100644
> --- a/drivers/dma/qcom/gpi.c
> +++ b/drivers/dma/qcom/gpi.c
> @@ -1605,14 +1605,16 @@ static int
>  gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config)
>  {
>  	struct gchan *gchan = to_gchan(chan);
> +	void *new_config;
>  
>  	if (!config->peripheral_config)
>  		return -EINVAL;
>  
> -	gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
> -	if (!gchan->config)
> +	new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
> +	if (!new_config)
>  		return -ENOMEM;
>  
> +	gchan->config = new_config;
>  	memcpy(gchan->config, config->peripheral_config, config->peripheral_size);
>  
>  	return 0;
> -- 
> 2.39.5 (Apple Git-154)
> 
>