Skip to contentSkip to conversation

iommu/dma: Fix leak in non-contiguous API

PATCH Applied Ezequiel Garcia 3 participants 3 messages Jul 23, 2021 – Jul 26, 2021

Subsystems (4)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 iommu/dma: Fix leak in non-contiguous API

Currently, iommu_dma_alloc_noncontiguous() allocates a struct dma_sgt_handle object to hold some state needed for iommu_dma_free_noncontiguous().

However, the handle is neither freed nor returned explicitly by the ->alloc_noncontiguous method, and therefore seems leaked. This was found by code inspection, so please review carefully and test.

As a side note, it appears the struct dma_sgt_handle type is exposed to users of the DMA-API by linux/dma-map-ops.h, but is has no users or functions returning the type explicitly.

This may indicate it's a good idea to move the struct dma_sgt_handle type to drivers/iommu/dma-iommu.c. The decision is left to maintainers :-)

Fixes e817ee5f2f95c ("dma-iommu: implement ->alloc_noncontiguous")
---
 drivers/iommu/dma-iommu.c | 1 +
 1 file changed, 1 insertion(+)
drivers/iommu/dma-iommu.c +1 -0
index 4e34e8b26579..16c06a1aab80 100644
@@ -768,6 +768,7 @@ static void iommu_dma_free_noncontiguous(struct device *dev, size_t size,
 	__iommu_dma_unmap(dev, sgt->sgl->dma_address, size);
 	__iommu_dma_free_pages(sh->pages, PAGE_ALIGN(size) >> PAGE_SHIFT);
 	sg_free_table(&sh->sgt);
+	kfree(sh);
 }
 #endif /* CONFIG_DMA_REMAP */
 
Signature · 1 line
2.32.0
Reviewed-by on v1 1/1
#1 lore raw

Looks good,

Quoted 6 lines

As a side note, it appears the struct dma_sgt_handle type is exposed to users of the DMA-API by linux/dma-map-ops.h, but is has no users or functions returning the type explicitly.

This may indicate it's a good idea to move the struct dma_sgt_handle type to drivers/iommu/dma-iommu.c. The decision is left to maintainers :-)

linux/dma-map-ops.h is a helper header for the dma_ops implementations, not for users of the DMA API. sgt_handle, which references dma_sgt_handle is used in kernel/dma/mapping.c