MLK-14976: dma: virt-dma: free description after callback

Some drivers may access dma_async_tx_descriptor in callback such as
tty/serial/fsl_lpuart.c, but the description has already been freed
before callback, memory corrupt here. Move the free description
behind of callback.

Signed-off-by: Robin Gong <yibin.gong@nxp.com>

diff --git a/drivers/dma/virt-dma.c b/drivers/dma/virt-dma.c
index e47fc9b..c940cec 100644 (file)
--- a/drivers/dma/virt-dma.c
+++ b/drivers/dma/virt-dma.c
@@ -108,12 +108,13 @@ static void vchan_complete(unsigned long arg)
                dmaengine_desc_get_callback(&vd->tx, &cb);
 
                list_del(&vd->node);
+
+               dmaengine_desc_callback_invoke(&cb, NULL);
+
                if (dmaengine_desc_test_reuse(&vd->tx))
                        list_add(&vd->node, &vc->desc_allocated);
                else
                        vc->desc_free(vd);
-
-               dmaengine_desc_callback_invoke(&cb, NULL);
        }
 }