Re: [PATCH RESEND v5] dmaengine: sun6i-dma: Fix use-after-free in error handling paths

[Vinod Koul]

On Mon, 27 Jul 2026 14:11:42 +0800, Hongling Zeng wrote:
> In error handling paths, the for loop frees v_lli in the loop body,
> then accesses v_lli->v_lli_next and v_lli->p_lli_next in the
> increment expression, which is use-after-free.
> 
> Fix by refactoring the cleanup into a helper function sun6i_dma_free_desc()
> that saves both the next virtual and physical pointers before freeing the
> current node, preventing the use-after-free.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: sun6i-dma: Fix use-after-free in error handling paths
      commit: 3d2c0d555d34e661d3280f85bf01ec7ed63a8f44

Best regards,
-- 
~Vinod