From 7f16b00c65606fd08085bda43b95e540f2e07b1f Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:44:24 +0800
Subject: [PATCH] ub: ubase: clear the ctx buffer iova slot when filling it
 fails

ubase_alloc_and_fill_ctx_buf() allocates the IOVA slot for a context
buffer and then fills it. If the fill fails, the error path calls
dma_free_iova() on the slot but leaves ctx_buf->slot pointing at the
freed slot, unlike ubase_free_and_clear_ctx_buf() which the caller uses on
its other error paths.

The context buffer stays in the device structure with a stale slot, and
ubase_uninit_ctx_buf() - reached from ubase_hw_uninit() on device
teardown and on the reset path - walks all five context buffers of
udev->ctx_buf and frees the slot of each one whose pointer is non-NULL.
The stale pointer makes it free the same IOVA slot a second time:
drain_pages(), domain_free_iova() and free_iova_slot() then operate on
freed memory.

The partially filled context pages are leaked the same way, because the
caller only destroys the xarray in its error path.

Free and clear the whole context buffer, as the other error paths do.

Fixes: 255239cba218 ("ub: ubase: Support for public Context memory allocation and release.")
---
 drivers/ub/ubase/ubase_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ub/ubase/ubase_hw.c b/drivers/ub/ubase/ubase_hw.c
index f6b5bf3404e6..111adc72b46a 100644
--- a/drivers/ub/ubase/ubase_hw.c
+++ b/drivers/ub/ubase/ubase_hw.c
@@ -422,7 +422,7 @@ static int ubase_alloc_and_fill_ctx_buf(struct ubase_dev *udev,
 		ubase_err(udev,
 			  "failed to fill inherent ctx buf, cmd = 0x%x, ret = %d.\n",
 			  attr->op, ret);
-		dma_free_iova(ctx_buf->slot);
+		ubase_free_and_clear_ctx_buf(udev, ctx_buf);
 	}
 
 	return ret;
-- 
Gitee