iommu: Fix potential memory leak in iopf_queue_remove_device()
Subsystems (2)
PATCH 1/1 iommu: Fix potential memory leak in iopf_queue_remove_device()
The iopf_queue_remove_device() helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the device from the queue.
However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if iopf_queue_remove_device() is called with pending iopf's.
Fix it by calling iopf_free_group() after the iopf group is responded.
--- drivers/iommu/io-pgfault.c | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/io-pgfault.c +1 -0
@@ -478,6 +478,7 @@ void iopf_queue_remove_device(struct iopf_queue *queue, struct device *dev) ops->page_response (dev, iopf, &resp);list_del_init (&group->pending_node); +iopf_free_group (group); }mutex_unlock (&fault_param->lock);
Signature · 1 line
2.43.0
Quoted 15 lines
From: Lu Baolu <[email protected]>
Sent: Friday, January 17, 2025 1:58 PMThe
iopf_queue_remove_device()helper removes a device from the per- iommu
iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with anIOMMU_PAGE_RESP_INVALIDcode and detaches the
device from the queue.However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if
iopf_queue_remove_device()is called with pending iopf's.
Quoted 6 lines
Fix it by calling
iopf_free_group()after the iopf group is responded.Fixes 199112327135 ("iommu: Track iopf group instead of last fault")Suggested-by Kevin Tian <[email protected]>Signed-off-by Lu Baolu <[email protected]>
Quoted 12 lines · Lu Baolu
The
iopf_queue_remove_device()helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with anIOMMU_PAGE_RESP_INVALIDcode and detaches the device from the queue.However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if
iopf_queue_remove_device()is called with pending iopf's.Fix it by calling
iopf_free_group()after the iopf group is responded.
Quoted 7 lines
Fixes 199112327135 ("iommu: Track iopf group instead of last fault")Suggested-by Kevin Tian <[email protected]>Signed-off-by Lu Baolu <[email protected]>--- drivers/iommu/io-pgfault.c | 1 + 1 file changed, 1 insertion(+)
Jason
Joerg Roedel
maintainerQuoted 10 lines · Lu Baolu
The
iopf_queue_remove_device()helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with anIOMMU_PAGE_RESP_INVALIDcode and detaches the device from the queue.However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if
iopf_queue_remove_device()is called with pending iopf's.
Quoted 6 lines
Fix it by calling
iopf_free_group()after the iopf group is responded.Fixes 199112327135 ("iommu: Track iopf group instead of last fault")Suggested-by Kevin Tian <[email protected]>Signed-off-by Lu Baolu <[email protected]>
Applied for -rc3, thanks.