[PATCH] dmaengine: sf-pdma: fix double-free of the in-flight descriptor

[Haotian Zhang]

The descriptors handed to sf_pdma_issue_pending() and
sf_pdma_donebh_tasklet() come from the virt-dma desc_issued list
(sf_pdma_get_first_pending_desc() returns list_first_entry() of that
list), so chan->desc always refers to a descriptor that is still linked
on a virt-dma list while a transfer is in flight.

sf_pdma_free_chan_resources() and sf_pdma_terminate_all() free that
descriptor with kfree(chan->desc) and then call
vchan_get_all_descriptors(), which splices desc_issued into the local
head list, so vchan_dma_desc_free_list() frees the very same object
again through sf_pdma_free_desc(), causing a double-free (and a
use-after-free for the pending tasklets).

Drop the direct kfree(chan->desc) calls so the in-flight descriptor is
freed only once by vchan_dma_desc_free_list().

Fixes: 6973886ad58e ("dmaengine: sf-pdma: add platform DMA support for HiFive Unleashed A00")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab at iscas.ac.cn>
---
 drivers/dma/sf-pdma/sf-pdma.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c
index 6f79cc28703e..40f556e198b4 100644
--- a/drivers/dma/sf-pdma/sf-pdma.c
+++ b/drivers/dma/sf-pdma/sf-pdma.c
@@ -144,7 +144,6 @@ static void sf_pdma_free_chan_resources(struct dma_chan *dchan)
 
 	spin_lock_irqsave(&chan->vchan.lock, flags);
 	sf_pdma_disable_request(chan);
-	kfree(chan->desc);
 	chan->desc = NULL;
 	vchan_get_all_descriptors(&chan->vchan, &head);
 	sf_pdma_disclaim_chan(chan);
@@ -214,7 +213,6 @@ static int sf_pdma_terminate_all(struct dma_chan *dchan)
 
 	spin_lock_irqsave(&chan->vchan.lock, flags);
 	sf_pdma_disable_request(chan);
-	kfree(chan->desc);
 	chan->desc = NULL;
 	chan->xfer_err = false;
 	vchan_get_all_descriptors(&chan->vchan, &head);
-- 
2.25.1