Skip to contentSkip to conversation

dmaengine: idxd: double free of devm_ memory on probe error

PATCH New Dan Carpenter 3 participants 3 messages May 8, 2021 – May 10, 2021

Subsystems (3)
Kernel janitors dmaengine Intel IDXD driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 dmaengine: idxd: double free of devm_ memory on probe error

The "idxd->int_handles" pointer is allocated with devm_kcalloc() so freeing it here leads to a double free. Delete the kfree().

Fixes eb15e7154fbf ("dmaengine: idxd: add interrupt handle request and release support")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/dma/idxd/init.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/dma/idxd/init.c +1 -3
index 2a926bef87f2..b65d28895955 100644
@@ -318,7 +318,7 @@ static int idxd_setup_internals(struct idxd_device *idxd)
 
 	rc = idxd_setup_wqs(idxd);
 	if (rc < 0)
-		goto err_wqs;
+		return rc;
 
 	rc = idxd_setup_engines(idxd);
 	if (rc < 0)

@@ -345,8 +345,6 @@ static int idxd_setup_internals(struct idxd_device *idxd)
  err_engine:
 	for (i = 0; i < idxd->max_wqs; i++)
 		put_device(&idxd->wqs[i]->conf_dev);
- err_wqs:
-	kfree(idxd->int_handles);
 	return rc;
 }
Signature · 1 line
2.30.2
reviewer
#1 lore raw

PATCH 1/1 dmaengine: idxd: remove devm allocation for idxd->int_handles

Allocation of idxd->int_handles was merged incorrectly for the 5.13 merge window. The devm_kcalloc should've been regular kcalloc due to devm_* removal series for the driver.

Fixes eb15e7154fbf ("dmaengine: idxd: add interrupt handle request and release support")
Reported-by Dan Carpenter <[email protected]>
Signed-off-by Dave Jiang <[email protected]>
---
 drivers/dma/idxd/init.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/dma/idxd/init.c +2 -1
index 2a926bef87f2..21d3dcb1c0e3 100644
@@ -311,7 +311,8 @@ static int idxd_setup_internals(struct idxd_device *idxd)
 	init_waitqueue_head(&idxd->cmd_waitq);
 
 	if (idxd->hw.cmd_cap & BIT(IDXD_CMD_REQUEST_INT_HANDLE)) {
-		idxd->int_handles = devm_kcalloc(dev, idxd->max_wqs, sizeof(int), GFP_KERNEL);
+		idxd->int_handles = kcalloc_node(idxd->max_wqs, sizeof(int), GFP_KERNEL,
+						 dev_to_node(dev));
 		if (!idxd->int_handles)
 			return -ENOMEM;
 	}
maintainer Applied
#2 lore raw

Re: [PATCH] dmaengine: idxd: remove devm allocation for idxd->int_handles

Quoted 3 lines · Dave Jiang

Allocation of idxd->int_handles was merged incorrectly for the 5.13 merge window. The devm_kcalloc should've been regular kcalloc due to devm_* removal series for the driver.

Applied, thanks

Signature · 1 line
~Vinod