ub: ubase: clear the ctx buffer iova slot when filling it fails · Pull Request !1137 · OpenCloudOS/OpenCloudOS-Kernel

## Problem

`ubase_alloc_and_fill_ctx_buf()` allocates the IOVA slot for a context buffer
and then fills it. When the fill fails, the error path calls `dma_free_iova()`
on the slot but leaves `ctx_buf->slot` pointing at the freed slot — unlike
`ubase_free_and_clear_ctx_buf()`, which the caller already uses on its other
error paths.

The context buffer stays in `udev->ctx_buf` with a stale slot.
`ubase_uninit_ctx_buf()`, reached from `ubase_hw_uninit()` on device teardown
and on the reset path, walks all five context buffers of `udev->ctx_buf` and
frees the slot of each one whose pointer is non-NULL, so the same IOVA slot is
freed a second time: `drain_pages()`, `domain_free_iova()` and
`free_iova_slot()` then run on freed memory (the slot itself is `kfree()`d).

The partially filled context pages leak the same way, because the caller only
destroys the xarray in its error path.

## Fix

Call `ubase_free_and_clear_ctx_buf()` here as well: it destroys the context
pages that were already filled, frees the IOVA slot and clears both `slot` and
`dma_ctx_buf_ba`.

## Verification

- `scripts/checkpatch.pl --no-signoff --strict`: 0 errors, 0 warnings.
- arm64 build (`CONFIG_UB=y`, `CONFIG_UB_UBUS`, `CONFIG_UB_UBUS_BUS`, `CONFIG_UB_UBUS_USI`, `CONFIG_UB_UMMU_CORE`, `CONFIG_UB_UBASE=y`, target `drivers/ub/ubase/`, Bootlin aarch64 gcc 15.3.0, `W=1`): baseline and patched trees both build with exit 0 and produce all 15 objects; both report the same 7 pre-existing warnings (missing prototypes and kerneldoc mismatches in `ubase_cmd.c` / `ubase_ctrlq.c`, neither touched here).
- Not run: runtime test. No UB hardware is available in the development environment, and the path needs the context buffer fill to fail.

类型	指派人员	状态
审查	zoucao Huang Cun Jianping Liu	已完成 (0/0人)
测试	Jianping Liu	已完成 (0/0人)

GVPOpenCloudOS / OpenCloudOS-Kernel

搜索帮助

GVP OpenCloudOS / OpenCloudOS-Kernel