The following patch introduced an issue.
    commit f6206f00d8c5 ("dmaengine: mic_x100_dma: use the new helper to 
simplify the code")

This issue is :

        kfree(mic_dma_dev)
        .....
        dma_async_device_unregister(mic_dma_dev->device);

Free the memory, and use it again.

So use devm_kzalloc to allocate mic_dma_dev to fix it.

When the Devres try to release the resources, it will call release at the
following order:

        dma_async_device_unregister(mic_dma_dev->device);
        .....
        kfree(mic_dma_dev)

Fixes: f6206f00d8c5 ("dmaengine: mic_x100_dma: use the new helper to simplify 
the code")
Signed-off-by: Huang Shijie <sjhu...@iluvatar.ai>
---
v1 --> v2:
     Change the commit message and title
---
 drivers/dma/mic_x100_dma.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/dma/mic_x100_dma.c b/drivers/dma/mic_x100_dma.c
index b76cb17d879c..adfd316db1a8 100644
--- a/drivers/dma/mic_x100_dma.c
+++ b/drivers/dma/mic_x100_dma.c
@@ -639,7 +639,7 @@ static struct mic_dma_device *mic_dma_dev_reg(struct 
mbus_device *mbdev,
        int ret;
        struct device *dev = &mbdev->dev;
 
-       mic_dma_dev = kzalloc(sizeof(*mic_dma_dev), GFP_KERNEL);
+       mic_dma_dev = devm_kzalloc(dev, sizeof(*mic_dma_dev), GFP_KERNEL);
        if (!mic_dma_dev) {
                ret = -ENOMEM;
                goto alloc_error;
@@ -664,7 +664,6 @@ static struct mic_dma_device *mic_dma_dev_reg(struct 
mbus_device *mbdev,
 reg_error:
        mic_dma_uninit(mic_dma_dev);
 init_error:
-       kfree(mic_dma_dev);
        mic_dma_dev = NULL;
 alloc_error:
        dev_err(dev, "Error at %s %d ret=%d\n", __func__, __LINE__, ret);
@@ -674,7 +673,6 @@ static struct mic_dma_device *mic_dma_dev_reg(struct 
mbus_device *mbdev,
 static void mic_dma_dev_unreg(struct mic_dma_device *mic_dma_dev)
 {
        mic_dma_uninit(mic_dma_dev);
-       kfree(mic_dma_dev);
 }
 
 /* DEBUGFS CODE */
-- 
2.17.1

Reply via email to