In ls1x_dma_prep_dma_cyclic(), a descriptor is allocated with
ls1x_dma_alloc_desc(). If the subsequent allocation for the scatterlist
fails, the function returns NULL without freeing the descriptor, which
causes a memory leak.

Fix this by calling ls1x_dma_free_desc() in the error path to ensure
the descriptor is freed.

Fixes: e06c432312148 ("dmaengine: Loongson1: Add Loongson-1 APB DMA driver")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/dma/loongson1-apb-dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/loongson1-apb-dma.c b/drivers/dma/loongson1-apb-dma.c
index 255fe7eca212..5ee829bc5c77 100644
--- a/drivers/dma/loongson1-apb-dma.c
+++ b/drivers/dma/loongson1-apb-dma.c
@@ -336,8 +336,10 @@ ls1x_dma_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t buf_addr,
 	/* allocate the scatterlist */
 	sg_len = buf_len / period_len;
 	sgl = kmalloc_array(sg_len, sizeof(*sgl), GFP_NOWAIT);
-	if (!sgl)
+	if (!sgl) {
+		ls1x_dma_free_desc(&desc->vd);
 		return NULL;
+	}
 
 	sg_init_table(sgl, sg_len);
 	for (i = 0; i < sg_len; ++i) {
-- 
2.34.1

On Mon, Nov 10, 2025 at 4:52 PM Zilin Guan <zilin@seu.edu.cn> wrote:
>
> In ls1x_dma_prep_dma_cyclic(), a descriptor is allocated with
> ls1x_dma_alloc_desc(). If the subsequent allocation for the scatterlist
> fails, the function returns NULL without freeing the descriptor, which
> causes a memory leak.
>
> Fix this by calling ls1x_dma_free_desc() in the error path to ensure
> the descriptor is freed.
>
> Fixes: e06c432312148 ("dmaengine: Loongson1: Add Loongson-1 APB DMA driver")
> Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
> ---
>  drivers/dma/loongson1-apb-dma.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/loongson1-apb-dma.c b/drivers/dma/loongson1-apb-dma.c
> index 255fe7eca212..5ee829bc5c77 100644
> --- a/drivers/dma/loongson1-apb-dma.c
> +++ b/drivers/dma/loongson1-apb-dma.c
> @@ -336,8 +336,10 @@ ls1x_dma_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t buf_addr,
>         /* allocate the scatterlist */
>         sg_len = buf_len / period_len;
>         sgl = kmalloc_array(sg_len, sizeof(*sgl), GFP_NOWAIT);
> -       if (!sgl)
> +       if (!sgl) {
> +               ls1x_dma_free_desc(&desc->vd);
>                 return NULL;
> +       }
>
>         sg_init_table(sgl, sg_len);
>         for (i = 0; i < sg_len; ++i) {
> --
> 2.34.1
>
Reviewed-by: Keguang Zhang <keguang.zhang@gmail.com>

-- 
Best regards,

Keguang Zhang