git: c2186638ff70 - main - ufshci: free the correct address when DMA load fails

The branch main has been updated by jaeyoon:

URL: https://cgit.FreeBSD.org/src/commit/?id=c2186638ff7052e3803f2bdab9ad62cfb69ac7de

commit c2186638ff7052e3803f2bdab9ad62cfb69ac7de
Author:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
AuthorDate: 2026-08-10 01:40:28 +0000
Commit:     Jaeyoon Choi <jaeyoon@FreeBSD.org>
CommitDate: 2026-08-10 02:28:49 +0000

    ufshci: free the correct address when DMA load fails
    
    The bus_dmamap_load() error paths passed hwq->utrd and req_queue->ucd
    to bus_dmamem_free(), but both pointers are only assigned after a
    successful load and are still NULL at that point. The freshly
    allocated memory was leaked. Free the local buffer instead.
    
    Sponsored by:           Samsung Electronics
    Reviewed by:            imp (mentor)
    Differential Revision:  https://reviews.freebsd.org/D58659
---
 sys/dev/ufshci/ufshci_req_sdb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/dev/ufshci/ufshci_req_sdb.c b/sys/dev/ufshci/ufshci_req_sdb.c
index 54542f48b32c..cc99b645331c 100644
--- a/sys/dev/ufshci/ufshci_req_sdb.c
+++ b/sys/dev/ufshci/ufshci_req_sdb.c
@@ -112,7 +112,7 @@ ufshci_req_sdb_cmd_desc_construct(struct ufshci_req_queue *req_queue,
 	if (bus_dmamap_load(req_queue->dma_tag_ucd, req_queue->ucdmem_map,
 		ucdmem, ucd_allocsz, ufshci_ucd_map, hwq, 0) != 0) {
 		ufshci_printf(ctrlr, "failed to load cmd desc memory\n");
-		bus_dmamem_free(req_queue->dma_tag_ucd, req_queue->ucd,
+		bus_dmamem_free(req_queue->dma_tag_ucd, ucdmem,
 		    req_queue->ucdmem_map);
 		goto out;
 	}
@@ -222,7 +222,7 @@ ufshci_req_sdb_construct(struct ufshci_controller *ctrlr,
 	if (bus_dmamap_load(hwq->dma_tag_queue, hwq->queuemem_map, queuemem,
 		alloc_size, ufshci_single_map, &queuemem_phys, 0) != 0) {
 		ufshci_printf(ctrlr, "failed to load request queue memory\n");
-		bus_dmamem_free(hwq->dma_tag_queue, hwq->utrd,
+		bus_dmamem_free(hwq->dma_tag_queue, queuemem,
 		    hwq->queuemem_map);
 		goto out;
 	}