1a3389ffc5
The dma_common_pages_remap() function allocates a vm_struct object and initialises the pages pointer to value passed as argument. However, when this function is called dma_common_contiguous_remap(), the pages array is only temporarily allocated, being freed shortly after dma_common_contiguous_remap() returns. Architecture code checking the validity of an area->pages pointer would incorrectly dereference already freed pointers. This has been exposed by the arm64 commit |
||
|---|---|---|
| .. | ||
| power | ||
| regmap | ||
| test | ||
| Kconfig | ||
| Makefile | ||
| attribute_container.c | ||
| base.h | ||
| bus.c | ||
| cacheinfo.c | ||
| class.c | ||
| component.c | ||
| container.c | ||
| core.c | ||
| cpu.c | ||
| dd.c | ||
| devcoredump.c | ||
| devres.c | ||
| devtmpfs.c | ||
| dma-coherent.c | ||
| dma-contiguous.c | ||
| dma-mapping.c | ||
| driver.c | ||
| firmware.c | ||
| firmware_class.c | ||
| hypervisor.c | ||
| init.c | ||
| isa.c | ||
| map.c | ||
| memory.c | ||
| module.c | ||
| node.c | ||
| pinctrl.c | ||
| platform-msi.c | ||
| platform.c | ||
| property.c | ||
| soc.c | ||
| syscore.c | ||
| topology.c | ||
| transport_class.c | ||