Commit 09c091fd authored by Thorsten Blum's avatar Thorsten Blum Committed by Jason Gunthorpe
Browse files

iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} 

mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
but its error path and mock_viommu_destroy() only release the first page
using free_page(), leaking the second page. Use free_pages() with the
matching order instead to avoid any page leaks.

Fixes: 80478a2b ("iommufd/selftest: Add coverage for the new mmap interface")
Link: https://patch.msgid.link/r/20260312164040.457293-3-thorsten.blum@linux.dev


Signed-off-by: default avatarThorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Reviewed-by: default avatarPranjal Shrivastava <praan@google.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 7147ec87

drivers/iommu/iommufd/selftest.c

+2 −2
Original line number Diff line number Diff line
@@ -636,7 +636,7 @@ static void mock_viommu_destroy(struct iommufd_viommu *viommu) 
	if (mock_viommu->mmap_offset)

		iommufd_viommu_destroy_mmap(&mock_viommu->core,

					    mock_viommu->mmap_offset);

	free_page((unsigned long)mock_viommu->page);

	free_pages((unsigned long)mock_viommu->page, 1);

	mutex_destroy(&mock_viommu->queue_mutex);



	/* iommufd core frees mock_viommu and viommu */
@@ -870,7 +870,7 @@ static int mock_viommu_init(struct iommufd_viommu *viommu, 
	iommufd_viommu_destroy_mmap(&mock_viommu->core,

				    mock_viommu->mmap_offset);

err_free_page:

	free_page((unsigned long)mock_viommu->page);

	free_pages((unsigned long)mock_viommu->page, 1);

	return rc;

}