mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-02-16 20:05:13 -05:00
1a3389ffc5
The dma_common_pages_remap() function allocates a vm_struct object and initialises the pages pointer to value passed as argument. However, when this function is called dma_common_contiguous_remap(), the pages array is only temporarily allocated, being freed shortly after dma_common_contiguous_remap() returns. Architecture code checking the validity of an area->pages pointer would incorrectly dereference already freed pointers. This has been exposed by the arm64 commit44176bb38f("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU"). Fixes:513510ddba("common: dma-mapping: introduce common remapping functions") Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reported-by: Andrzej Hajda <a.hajda@samsung.com> Acked-by: Laura Abbott <labbott@redhat.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>