diff options
| author | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 01:40:28 +0000 |
|---|---|---|
| committer | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 02:28:49 +0000 |
| commit | c2186638ff7052e3803f2bdab9ad62cfb69ac7de (patch) | |
| tree | 5a5fdb4fcdd570f7631cb2fda431d2c50ecbd100 | |
| parent | c84c2bf78b39058a339551117323668c933f6162 (diff) | |
ufshci: free the correct address when DMA load fails
The bus_dmamap_load() error paths passed hwq->utrd and req_queue->ucd
to bus_dmamem_free(), but both pointers are only assigned after a
successful load and are still NULL at that point. The freshly
allocated memory was leaked. Free the local buffer instead.
Sponsored by: Samsung Electronics
Reviewed by: imp (mentor)
Differential Revision: https://reviews.freebsd.org/D58659
| -rw-r--r-- | sys/dev/ufshci/ufshci_req_sdb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c index 54542f48b32c..cc99b645331c 100644 --- a/sys/dev/ufshci/ufshci_req_sdb.c +++ b/sys/dev/ufshci/ufshci_req_sdb.c @@ -112,7 +112,7 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue, if (bus_dmamap_load(req_queue->dma_tag_ucd, req_queue->ucdmem_map, ucdmem, ucd_allocsz, ufshci_ucd_map, hwq, 0) != 0) { ufshci_printf(ctrlr, "failed to load cmd desc memory\n"); - bus_dmamem_free(req_queue->dma_tag_ucd, req_queue->ucd, + bus_dmamem_free(req_queue->dma_tag_ucd, ucdmem, req_queue->ucdmem_map); goto out; } @@ -222,7 +222,7 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr, if (bus_dmamap_load(hwq->dma_tag_queue, hwq->queuemem_map, queuemem, alloc_size, ufshci_single_map, &queuemem_phys, 0) != 0) { ufshci_printf(ctrlr, "failed to load request queue memory\n"); - bus_dmamem_free(hwq->dma_tag_queue, hwq->utrd, + bus_dmamem_free(hwq->dma_tag_queue, queuemem, hwq->queuemem_map); goto out; } |