Skip to contentSkip to conversation

crypto: qat - free dc_data with kfree() in the error path

PATCH In review ZhaoJinming 3 participants 3 messages Oct 19 – Nov 6

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 crypto: qat - free dc_data with kfree() in the error path

qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but its error path releases it with devm_kfree():

	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
			       dev_to_node(dev));
	...
err:
	accel_dev->dc_data = NULL;
	kfree(obuff);
	devm_kfree(dev, dc_data);

devm_kfree() only frees memory that was allocated with devm_kmalloc() and registered with the device resource manager. dc_data is a plain kmalloc allocation that was never registered, so devres_destroy() does not find it, returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing anything. The dc_data structure is leaked.

Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data") switched dc_data to unmanaged allocation and replaced the devm_kfree() in qat_free_dc_data(), but missed the identical call in the error path of qat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.

Free dc_data with kfree() here as well, matching the allocation and the other release path.

Fixes 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
---
 drivers/crypto/intel/qat/qat_common/qat_compression.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/intel/qat/qat_common/qat_compression.c +1 -1
index 8129ad0c32d8..7a5b648302a0 100644
@@ -241,7 +241,7 @@ static int qat_compression_alloc_dc_data(struct adf_accel_dev *accel_dev)
 err:
 	accel_dev->dc_data = NULL;
 	kfree(obuff);
-	devm_kfree(dev, dc_data);
+	kfree(dc_data);
 	return -ENOMEM;
 }
 

---
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
change-id: 20261019-qat-dc-data-kfree-76c7e1ddc2a7

Best regards,

Signature · 1 line
ZhaoJinming <[email protected]>
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 23 lines · ZhaoJinming

qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but its error path releases it with devm_kfree():

	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
			       dev_to_node(dev));
	...
err:
	accel_dev->dc_data = NULL;
	kfree(obuff);
	devm_kfree(dev, dc_data);

devm_kfree() only frees memory that was allocated with devm_kmalloc() and registered with the device resource manager. dc_data is a plain kmalloc allocation that was never registered, so devres_destroy() does not find it, returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing anything. The dc_data structure is leaked.

Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data") switched dc_data to unmanaged allocation and replaced the devm_kfree() in qat_free_dc_data(), but missed the identical call in the error path of qat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.

Quoted 6 lines

Free dc_data with kfree() here as well, matching the allocation and the other release path.

Fixes 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")

Regards,

Signature · 1 line
Giovanni
maintainer
#2 lore raw
In reply to ZhaoJinming
Quoted 26 lines · ZhaoJinming

qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but its error path releases it with devm_kfree():

	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
			       dev_to_node(dev));
	...
err:
	accel_dev->dc_data = NULL;
	kfree(obuff);
	devm_kfree(dev, dc_data);

devm_kfree() only frees memory that was allocated with devm_kmalloc() and registered with the device resource manager. dc_data is a plain kmalloc allocation that was never registered, so devres_destroy() does not find it, returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing anything. The dc_data structure is leaked.

Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data") switched dc_data to unmanaged allocation and replaced the devm_kfree() in qat_free_dc_data(), but missed the identical call in the error path of qat_compression_alloc_dc_data(). That path is taken when the overflow buffer allocation or its DMA mapping fails.

Free dc_data with kfree() here as well, matching the allocation and the other release path.

Quoted 6 lines
Fixes 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
---
 drivers/crypto/intel/qat/qat_common/qat_compression.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied. Thanks.

Signature · 3 lines
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt