From nobody Tue Jun 16 19:35:41 2026 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FD73342510 for ; Mon, 20 Apr 2026 13:59:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776693600; cv=none; b=DlpHRDUTEK3+cekPeuIXZc86HbVA7T+2aUmHcuJWhOvq1DE4PRpMvKmQaPFKv0PoIv/h/Xx0Pds8dnV2nDdnUI7Ctl6Euc+SY0CuBu9/oHLUCBHOgj0Q1S1dV/rwtil1jbzXGDs+XgUQZupnq7FMRb1xkheTU3EPeDdbSu2Hcx8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776693600; c=relaxed/simple; bh=SrgFMyROmHNBLrFbCgp+FteKbeTypwiuhwV7d4eZYLc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=G4N9NP9zaJTe9BY6q1Jkzyh3NOxejk4zquWl449mSi5fPm8ohnj0S55pi8+tF6r6eWqiViFIkaJcPpGkbYXEy707U3rNET8vN4YcozOyXAfb5fda9JmXKS1hE9d3Gm8TRKaDn2kePenzPnb5xbweLBJcIVQcwk0UAl5+wh3dJc4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Dz0otMsN; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Dz0otMsN" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2b24fdac394so29157675ad.3 for ; Mon, 20 Apr 2026 06:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776693599; x=1777298399; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=PtA7XaAsBped8tzDKGVHSMvp1WbWNwbAvXQ8vkybz/I=; b=Dz0otMsNBrkSCoftCpN6lgdJzZGySk2ML3Gi0iXbv4MCNDcOPEhpj+lzWWGNAlbTAI hL2n4lmaRlU3GmtU8jNskPwEi6F2ovaH+6OAqlm9wCNLSS9HWwbkGzzUOHvE2j9iNhsQ BR2EL2o/NDPHLoAax39Y6aqKBbvz7rymXPprPa4Y4gAFtnyI+VamwVwrYGzO4/Yi0O9v uAczbASKykuQQhrzoG024NKStsrgEOkJEUNcrMANQ7x/2PVMxLAOHKrnY/uYGW1tEnba B+7JrHXdFh2e6++zQpz9V54zoYVPhS1zuk73L4iSslChBoWx9nG07AJUvtONCg1LoVs3 FfLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776693599; x=1777298399; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=PtA7XaAsBped8tzDKGVHSMvp1WbWNwbAvXQ8vkybz/I=; b=nWpJcriTMpRKYXPkik63vHHR2S2Wtrk141o3z/ctZTHJXV70ZOwtRLxTgymsuPNoPJ LD9ZRVKxsjtDGEsgzNnat++hvCGjkWsQyE2+yEl4Bt8ZU2E23rSdkXC6GsHWRbbTKH88 U8B7h4YRqtl6QDAJmXpRGUg74DorQQGOsLAWWCVNS/2VdIReyNW5EUOXrzxO54tUe3DG aXEUynFPi/rmpoM+EruvpAQ2KWrNWugiUzXagxi4d7XDTR79R+LMpSCSVpJKkzMOkz2D gN+JRwdWnCMrM2cJWaKWEYih11hJIMtYNme2qmpjnDJIpp/lLOoQ3K7BrAM8pcMS5eib fv6w== X-Forwarded-Encrypted: i=1; AFNElJ/tsGfQtDgSUaOivlLrNdIe94FrY7BTdq1Vz2wQYH9BJU9y+NXPGO7iit6epjlxsSs9NybRs+7sA+7r2xA=@vger.kernel.org X-Gm-Message-State: AOJu0YxDl2Hl21Ug3NiB858EO6NhzSMpGyprnVNbgah2HPnsR8NvxQCG uFr+vuPysDWY2Mf+FEciGlLll0E6ZzGB8qsqPKMkLy9ddpsM/IcL+C8f X-Gm-Gg: AeBDiesYqpPluuTnDva3PkqAorN+6IRlhcUxD8dYetRuffjRSFUQ9badUI74XVlxQl/ m68IBqS/wPa1mvjwgkSnZjRZFL5apwYq2lu8Syjd3liFNdX35A/pq8a0KTEYdEiS7ZDFMa9MBkd OM3NDaDPencgO90RCaMHuVH4+UbLLP5Cp+Yyp7gyXSpwngCD7Sbp5cugiYMBlnm11aAj3GU4Yqm GliHbWf5+XeUGYxKJwEq5W1cYcV5ZwMK91u+gTt0XvGmrx6Zr3EuxSUL2aDIdvI9OQVtDJb4GIc hM/QJa2zBEqy3qbECWiZMy23kzn43eaQWmcfmKa8m0v4Nr78PmRRtahE+IhmM4G/TXoo/1tzOLZ 4yPWe6EJmJCxyqKMoS9zWbaIMd1oFIW8oWlGBB5oXQcEGRXrdDBgUrpXyRhosjQwDVgOwss6Zuz 81V9pAnmDOLnMIvZorhbfkFqn7mQhgLh99td8FB0p8xc15kj+AEs2YekaqbVEYhhAhI8LO8AW3 X-Received: by 2002:a17:902:ee84:b0:2b2:4697:78f4 with SMTP id d9443c01a7336-2b5f9fe094fmr113361365ad.31.1776693598648; Mon, 20 Apr 2026 06:59:58 -0700 (PDT) Received: from localhost.localdomain ([115.110.225.242]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b5fab0cd18sm112575965ad.45.2026.04.20.06.59.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Apr 2026 06:59:58 -0700 (PDT) From: Shitalkumar Gandhi X-Google-Original-From: Shitalkumar Gandhi To: gregkh@linuxfoundation.org, jirislaby@kernel.org Cc: bhuvanchandra.dv@toradex.com, Frank.Li@nxp.com, peng.fan@nxp.com, sherry.sun@nxp.com, linux-serial@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Shitalkumar Gandhi Subject: [PATCH] serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma Date: Mon, 20 Apr 2026 19:29:03 +0530 Message-Id: <20260420135903.2062024-1-shitalkumar.gandhi@cambiumnetworks.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" lpuart_start_rx_dma() allocates sport->rx_ring.buf with kzalloc() and then maps a scatterlist via dma_map_sg(). On three subsequent error paths the function returns directly without releasing those resources: - when dma_map_sg() returns 0 (-EINVAL): ring->buf is leaked. - when dmaengine_slave_config() fails: ring->buf and the DMA mapping are leaked. - when dmaengine_prep_dma_cyclic() returns NULL: ring->buf and the DMA mapping are leaked. The sole cleanup path, lpuart_dma_rx_free(), is only reached when lpuart_dma_rx_use is set, and the caller lpuart_rx_dma_startup() clears that flag on failure of lpuart_start_rx_dma(). So these resources are permanently leaked on every failure in this function. Repeated port open/close or termios changes under error conditions will slowly consume memory and leave stale streaming DMA mappings behind. Fix it by introducing two error labels that unmap the scatterlist and free the ring buffer as appropriate. While here, replace the misleading -EFAULT (bad userspace pointer) returned when dmaengine_prep_dma_cyclic() fails with the more accurate -ENOMEM, matching how other dmaengine users in the tree treat this failure. No functional change on the success path. Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") Cc: stable@vger.kernel.org Signed-off-by: Shitalkumar Gandhi Reviewed-by: Frank Li --- drivers/tty/serial/fsl_lpuart.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuar= t.c index f36d50fe056f..296a096be351 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1376,7 +1376,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_p= ort *sport) =20 if (!nent) { dev_err(sport->port.dev, "DMA Rx mapping error\n"); - return -EINVAL; + ret =3D -EINVAL; + goto err_free_buf; } =20 dma_rx_sconfig.src_addr =3D lpuart_dma_datareg_addr(sport); @@ -1388,7 +1389,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_p= ort *sport) if (ret < 0) { dev_err(sport->port.dev, "DMA Rx slave config failed, err =3D %d\n", ret); - return ret; + goto err_unmap_sg; } =20 sport->dma_rx_desc =3D dmaengine_prep_dma_cyclic(chan, @@ -1399,7 +1400,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_p= ort *sport) DMA_PREP_INTERRUPT); if (!sport->dma_rx_desc) { dev_err(sport->port.dev, "Cannot prepare cyclic DMA\n"); - return -EFAULT; + ret =3D -ENOMEM; + goto err_unmap_sg; } =20 sport->dma_rx_desc->callback =3D lpuart_dma_rx_complete; @@ -1423,6 +1425,13 @@ static inline int lpuart_start_rx_dma(struct lpuart_= port *sport) } =20 return 0; + +err_unmap_sg: + dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1, DMA_FROM_DEVICE); +err_free_buf: + kfree(ring->buf); + ring->buf =3D NULL; + return ret; } =20 static void lpuart_dma_rx_free(struct uart_port *port) --=20 2.25.1