[PATCH 2/2] dmaengine: sun6i: Fix use-after-free in cyclic LLI error cleanup

[Slavin Liu]

sun6i_dma_prep_dma_cyclic() allocates one pool-allocated LLI per
period (audio drivers routinely use several periods).  When a later
dma_pool_alloc() fails, the err_lli_free path frees each chained LLI
with dma_pool_free() in the loop body while the for-loop increment
reads v_lli->p_lli_next and v_lli->v_lli_next from the LLI that was
just returned to the pool and may already have been handed out again.

Cache both next fields of the current LLI before freeing it.

Same pattern as fixed in the slave sg path in the previous patch.

Fixes: a90e173f3faf ("dmaengine: sun6i: Add cyclic capability")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@xxxxxxxxxx>
---
 drivers/dma/sun6i-dma.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 025a43d0298d..4d6ee2fbd682 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -876,9 +876,14 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_cyclic(
 	return vchan_tx_prep(&vchan->vc, &txd->vd, flags);
 
 err_lli_free:
-	for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli;
-	     p_lli = v_lli->p_lli_next, v_lli = v_lli->v_lli_next)
+	for (p_lli = txd->p_lli, v_lli = txd->v_lli; v_lli;) {
+		dma_addr_t next_p_lli = v_lli->p_lli_next;
+		struct sun6i_dma_lli *next_v_lli = v_lli->v_lli_next;
+
 		dma_pool_free(sdev->pool, v_lli, p_lli);
+		p_lli = next_p_lli;
+		v_lli = next_v_lli;
+	}
 	kfree(txd);
 	return NULL;
 }
-- 
2.34.1