Date: Mon, 10 Aug 2026 02:31:22 +0000 From: Jaeyoon Choi <jaeyoon@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: c2186638ff70 - main - ufshci: free the correct address when DMA load fails Message-ID: <6a7937fa.1ea29.58281ac8@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=c2186638ff7052e3803f2bdab9ad62cfb69ac7de commit c2186638ff7052e3803f2bdab9ad62cfb69ac7de Author: Jaeyoon Choi <jaeyoon@FreeBSD.org> AuthorDate: 2026-08-10 01:40:28 +0000 Commit: Jaeyoon Choi <jaeyoon@FreeBSD.org> CommitDate: 2026-08-10 02:28:49 +0000 ufshci: free the correct address when DMA load fails The bus_dmamap_load() error paths passed hwq->utrd and req_queue->ucd to bus_dmamem_free(), but both pointers are only assigned after a successful load and are still NULL at that point. The freshly allocated memory was leaked. Free the local buffer instead. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58659 --- sys/dev/ufshci/ufshci_req_sdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c index 54542f48b32c..cc99b645331c 100644 --- a/sys/dev/ufshci/ufshci_req_sdb.c +++ b/sys/dev/ufshci/ufshci_req_sdb.c @@ -112,7 +112,7 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue, if (bus_dmamap_load(req_queue->dma_tag_ucd, req_queue->ucdmem_map, ucdmem, ucd_allocsz, ufshci_ucd_map, hwq, 0) != 0) { ufshci_printf(ctrlr, "failed to load cmd desc memory\n"); - bus_dmamem_free(req_queue->dma_tag_ucd, req_queue->ucd, + bus_dmamem_free(req_queue->dma_tag_ucd, ucdmem, req_queue->ucdmem_map); goto out; } @@ -222,7 +222,7 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr, if (bus_dmamap_load(hwq->dma_tag_queue, hwq->queuemem_map, queuemem, alloc_size, ufshci_single_map, &queuemem_phys, 0) != 0) { ufshci_printf(ctrlr, "failed to load request queue memory\n"); - bus_dmamem_free(hwq->dma_tag_queue, hwq->utrd, + bus_dmamem_free(hwq->dma_tag_queue, queuemem, hwq->queuemem_map); goto out; }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a7937fa.1ea29.58281ac8>