crypto: qat - free dc_data with kfree() in the error path
Subsystems (3)
PATCH 1/1 crypto: qat - free dc_data with kfree() in the error path
qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but its error path releases it with devm_kfree():
dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL, dev_to_node(dev)); ... err: accel_dev->dc_data = NULL; kfree(obuff); devm_kfree(dev, dc_data);
devm_kfree() only frees memory that was allocated with devm_kmalloc() and registered with the device resource manager. dc_data is a plain kmalloc allocation that was never registered, so devres_destroy() does not find it, returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing anything. The dc_data structure is leaked.
Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data") switched dc_data to unmanaged allocation and replaced the devm_kfree() in qat_free_dc_data(), but missed the identical call in the error path of qat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.
Free dc_data with kfree() here as well, matching the allocation and the other release path.
--- drivers/crypto/intel/qat/qat_common/qat_compression.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_common/qat_compression.c +1 -1
@@ -241,7 +241,7 @@ static int qat_compression_alloc_dc_data(struct adf_accel_dev *accel_dev) err: accel_dev->dc_data =NULL ;kfree (obuff); -devm_kfree (dev, dc_data); +kfree (dc_data);return -ENOMEM ; }
---
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
change-id: 20261019-qat-dc-data-kfree-76c7e1ddc2a7
Best regards,
Signature · 1 line
ZhaoJinming <[email protected]>
Quoted 23 lines · ZhaoJinming
qat_compression_alloc_dc_data()allocatesdc_datawithkzalloc_node(), but its error path releases it withdevm_kfree():dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL, dev_to_node(dev)); ... err: accel_dev->dc_data = NULL; kfree(obuff); devm_kfree(dev, dc_data);
devm_kfree()only frees memory that was allocated withdevm_kmalloc()and registered with the device resource manager.dc_datais a plain kmalloc allocation that was never registered, sodevres_destroy()does not find it, returns-ENOENTanddevm_kfree()ends up inWARN_ON()without freeing anything. Thedc_datastructure is leaked.Commit
4cc871ad0173("crypto: qat - use unmanaged allocation fordc_data") switcheddc_datato unmanaged allocation and replaced thedevm_kfree()inqat_free_dc_data(), but missed the identical call in the error path ofqat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.
Quoted 6 lines
Free
dc_datawithkfree()here as well, matching the allocation and the other release path.Fixes 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")Signed-off-by ZhaoJinming <[email protected]>
Regards,
Signature · 1 line
Giovanni
Herbert Xu
maintainerQuoted 26 lines · ZhaoJinming
qat_compression_alloc_dc_data()allocatesdc_datawithkzalloc_node(), but its error path releases it withdevm_kfree():dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL, dev_to_node(dev)); ... err: accel_dev->dc_data = NULL; kfree(obuff); devm_kfree(dev, dc_data);
devm_kfree()only frees memory that was allocated withdevm_kmalloc()and registered with the device resource manager.dc_datais a plain kmalloc allocation that was never registered, sodevres_destroy()does not find it, returns-ENOENTanddevm_kfree()ends up inWARN_ON()without freeing anything. Thedc_datastructure is leaked.Commit
4cc871ad0173("crypto: qat - use unmanaged allocation fordc_data") switcheddc_datato unmanaged allocation and replaced thedevm_kfree()inqat_free_dc_data(), but missed the identical call in the error path ofqat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.Free
dc_datawithkfree()here as well, matching the allocation and the other release path.
Quoted 6 lines
Fixes 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")Signed-off-by ZhaoJinming <[email protected]>--- drivers/crypto/intel/qat/qat_common/qat_compression.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Patch applied. Thanks.
Signature · 3 lines
Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt