[PATCH] uio: uio_dmem_genirq: fix crash when releasing failed DMA allocations

[zhangjiao2]

From: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>

In uio_dmem_genirq_open(), when dma_alloc_coherent() fails for a
dynamic memory region, uiomem->addr is set to DMEM_MAP_ERROR (~0).

In uio_dmem_genirq_release(), the condition to free DMA memory only
checks if uiomem->addr is non-zero. Since DMEM_MAP_ERROR is non-zero,
the driver attempts to call dma_free_coherent() with an invalid
virtual address (~0) and an uninitialized dma_addr, leading to a
kernel crash.

Add an explicit check against DMEM_MAP_ERROR before calling
dma_free_coherent() to skip regions where allocation had failed.

Signed-off-by: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/uio/uio_dmem_genirq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
index 41c18ec62a45..65ee0f3de326 100644
--- a/drivers/uio/uio_dmem_genirq.c
+++ b/drivers/uio/uio_dmem_genirq.c
@@ -87,7 +87,7 @@ static int uio_dmem_genirq_release(struct uio_info *info, struct inode *inode)
 	while (!priv->refcnt && uiomem < &priv->uioinfo->mem[MAX_UIO_MAPS]) {
 		if (!uiomem->size)
 			break;
-		if (uiomem->addr) {
+		if (uiomem->addr && uiomem->addr != DMEM_MAP_ERROR) {
 			dma_free_coherent(uiomem->dma_device, uiomem->size,
 					  (void *) (uintptr_t) uiomem->addr,
 					  uiomem->dma_addr);
-- 
2.33.0