From: Felix Gu <ustc.gu@gmail.com>
To: Mark Brown <broonie@kernel.org>,
H Hartley Sweeten <hsweeten@visionengravers.com>,
Grant Likely <grant.likely@secretlab.ca>,
Vinod Koul <vkoul@kernel.org>,
Mika Westerberg <mika.westerberg@iki.fi>
Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org,
Felix Gu <ustc.gu@gmail.com>
Subject: [PATCH] spi: ep93xx: fix double-free of zeropage on DMA setup failure
Date: Fri, 29 May 2026 23:31:06 +0800 [thread overview]
Message-ID: <20260529-ep93xx-v1-1-9185070ca1fc@gmail.com> (raw)
If DMA setup fails after allocating the zeropage, the error path frees
the page but leaves espi->zeropage dangling. A subsequent call to
ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page
again.
Clear the pointer after freeing in the error path of
ep93xx_spi_setup_dma().
Fixes: 626a96db1169 ("spi/ep93xx: add DMA support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
drivers/spi/spi-ep93xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index ea610b0537a9..bf389d7590d3 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -600,6 +600,7 @@ static int ep93xx_spi_setup_dma(struct device *dev, struct ep93xx_spi *espi)
espi->dma_rx = NULL;
fail_free_page:
free_page((unsigned long)espi->zeropage);
+ espi->zeropage = NULL;
return ret;
}
---
base-commit: f7af91adc230aa99e23330ecf85bc9badd9780ad
change-id: 20260529-ep93xx-8ac307cb5434
Best regards,
--
Felix Gu <ustc.gu@gmail.com>
next reply other threads:[~2026-05-29 15:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-29 15:31 Felix Gu [this message]
2026-06-08 18:03 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260529-ep93xx-v1-1-9185070ca1fc@gmail.com \
--to=ustc.gu@gmail.com \
--cc=broonie@kernel.org \
--cc=grant.likely@secretlab.ca \
--cc=hsweeten@visionengravers.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=mika.westerberg@iki.fi \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®