Linked-list descriptors are allocated from desc_pool and can be
released from omap_dma_free() through the channel descriptor cleanup
path. Destroying desc_pool before freeing channels leaves descriptor
cleanup with a dangling pool pointer.
Free the channels before destroying desc_pool in probe failure paths
and in remove.
Fixes: 1c2e8e6b6429 ("dmaengine: omap-dma: Support for LinkedList transfer of
slave_sg")
Fixes: 2e1136acf8a8 ("dmaengine: omap-dma: fix dma_pool resource leak in error
paths")
Cc: [email protected]
Assisted-by: Codex:GPT-5
Signed-off-by: Rosen Penev <[email protected]>
---
drivers/dma/ti/omap-dma.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index 61a935660341..c0890d8c43ba 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -1818,9 +1818,9 @@ static int omap_dma_probe(struct platform_device *pdev)
spin_unlock_irq(&od->irq_lock);
omap_dma_glbl_read(od, IRQENABLE_L1);
}
+ omap_dma_free(od);
if (od->ll123_supported)
dma_pool_destroy(od->desc_pool);
- omap_dma_free(od);
return rc;
}
@@ -1842,9 +1842,9 @@ static int omap_dma_probe(struct platform_device *pdev)
spin_unlock_irq(&od->irq_lock);
omap_dma_glbl_read(od, IRQENABLE_L1);
}
+ omap_dma_free(od);
if (od->ll123_supported)
dma_pool_destroy(od->desc_pool);
- omap_dma_free(od);
return rc;
}
}
@@ -1888,10 +1888,10 @@ static void omap_dma_remove(struct platform_device
*pdev)
omap_dma_glbl_write(od, IRQENABLE_L0, 0);
}
+ omap_dma_free(od);
+
if (od->ll123_supported)
dma_pool_destroy(od->desc_pool);
-
- omap_dma_free(od);
}
static const struct omap_dma_config omap2420_data = {
--
2.54.0
