loongson2_cmc_dma_prep_slave_sg() allocates the descriptor with
kzalloc_flex() before iterating over the scatterlist. If
loongson2_cmc_dma_set_xfer_param() fails inside the loop, the function
returns ERR_PTR(ret) without freeing the descriptor. At this point the
descriptor has not been handed to vchan_tx_prep() yet, so nothing else
will ever free it, leaking it on every failed ->device_prep_slave_sg()
call (e.g. an unsupported transfer direction or bus width).

The neighbouring error path for the num_items check already frees the
descriptor before returning; do the same on the set_xfer_param() failure
path.

Fixes: 1c0028e725f1 ("dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller")
Link: https://lore.kernel.org/all/20260818094957.7D2221F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012bUV3WshMSfTq61n1cgh1i
---
 drivers/dma/loongson/loongson2-apb-cmc-dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/loongson/loongson2-apb-cmc-dma.c b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
index 1c9a542edc85..60eb4d961610 100644
--- a/drivers/dma/loongson/loongson2-apb-cmc-dma.c
+++ b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
@@ -404,8 +404,10 @@ loongson2_cmc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
 	for_each_sg(sgl, sg, sg_len, i) {
 		ret = loongson2_cmc_dma_set_xfer_param(lchan, direction, &buswidth, sg_dma_len(sg));
-		if (ret)
+		if (ret) {
+			kfree(desc);
 			return ERR_PTR(ret);
+		}
 
 		num_items = DIV_ROUND_UP(sg_dma_len(sg), buswidth);
 		if (num_items >= LOONSON2_CMCDMA_MAX_DATA_ITEMS) {
-- 
2.55.0

On Sat, Sep 05, 2026 at 12:28:33AM -0600, Diego Fernando Mancera Gomez wrote:
> loongson2_cmc_dma_prep_slave_sg() allocates the descriptor with
> kzalloc_flex() before iterating over the scatterlist. If
> loongson2_cmc_dma_set_xfer_param() fails inside the loop, the function
> returns ERR_PTR(ret) without freeing the descriptor. At this point the
> descriptor has not been handed to vchan_tx_prep() yet, so nothing else
> will ever free it, leaking it on every failed ->device_prep_slave_sg()
> call (e.g. an unsupported transfer direction or bus width).
>
> The neighbouring error path for the num_items check already frees the
> descriptor before returning; do the same on the set_xfer_param() failure
> path.
>
> Fixes: 1c0028e725f1 ("dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller")
> Link: https://lore.kernel.org/all/20260818094957.7D2221F000E9@smtp.kernel.org/
> Cc: stable@vger.kernel.org
> Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
> Claude-Session: https://claude.ai/code/session_012bUV3WshMSfTq61n1cgh1i
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>


>  drivers/dma/loongson/loongson2-apb-cmc-dma.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/loongson/loongson2-apb-cmc-dma.c b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
> index 1c9a542edc85..60eb4d961610 100644
> --- a/drivers/dma/loongson/loongson2-apb-cmc-dma.c
> +++ b/drivers/dma/loongson/loongson2-apb-cmc-dma.c
> @@ -404,8 +404,10 @@ loongson2_cmc_dma_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
>
>  	for_each_sg(sgl, sg, sg_len, i) {
>  		ret = loongson2_cmc_dma_set_xfer_param(lchan, direction, &buswidth, sg_dma_len(sg));
> -		if (ret)
> +		if (ret) {
> +			kfree(desc);
>  			return ERR_PTR(ret);
> +		}
>
>  		num_items = DIV_ROUND_UP(sg_dma_len(sg), buswidth);
>  		if (num_items >= LOONSON2_CMCDMA_MAX_DATA_ITEMS) {
> --
> 2.55.0
>