Commits
![Peter Ujfalusi](https://secure.gravatar.com/avatar/be389a1bfb2870dcabd8e3d1251ce76c.jpg?s=96&d=mm)
Peter Ujfalusi committed fdfd8f9ef2d
dmaengine: virt-dma: Fix access after free in vchan_complete() commit 24461d9792c2c706092805ff1b067628933441bd upstream. vchan_vdesc_fini() is freeing up 'vd' so the access to vd->tx_result is via already freed up memory. Move the vchan_vdesc_fini() after invoking the callback to avoid this. Fixes: 09d5b702b0f97 ("dmaengine: virt-dma: store result on dma descriptor") Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com> Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com> Link: https://lore.kernel.org/r/20191220131100.21804-1-peter.ujfalusi@ti.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>