On Wed, Oct 29, 2025 at 08:34:19PM +0800, Miaoqian Lin wrote:

Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails.

The issue occurs when:

1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the reference to the original memory
4. The original memory becomes unreachable and cannot be freed

Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds.

Found via static analysis and code review.

Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin linmq006@gmail.com

Reviewed-by: Bjorn Andersson andersson@kernel.org

Regards, Bjorn

---

drivers/dma/qcom/gpi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c index 8e87738086b2..8908b7c71900 100644 --- a/drivers/dma/qcom/gpi.c +++ b/drivers/dma/qcom/gpi.c @@ -1605,14 +1605,16 @@ static int gpi_peripheral_config(struct dma_chan *chan, struct dma_slave_config *config) { struct gchan *gchan = to_gchan(chan);

• void *new_config;

if (!config->peripheral_config) return -EINVAL;

• gchan->config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
• if (!gchan->config)

• new_config = krealloc(gchan->config, config->peripheral_size, GFP_NOWAIT);
• if (!new_config) return -ENOMEM;

• gchan->config = new_config; memcpy(gchan->config, config->peripheral_config, config->peripheral_size);

return 0; -- 2.39.5 (Apple Git-154)