Commit 39aaa337 authored by Dan Carpenter's avatar Dan Carpenter Committed by Vinod Koul
Browse files

dmaengine: idxd: Fix double free in idxd_setup_wqs() 



The clean up in idxd_setup_wqs() has had a couple bugs because the error
handling is a bit subtle.  It's simpler to just re-write it in a cleaner
way.  The issues here are:

1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when
   "conf_dev" hasn't been initialized.
2) If kzalloc_node() fails then again "conf_dev" is invalid.  It's
   either uninitialized or it points to the "conf_dev" from the
   previous iteration so it leads to a double free.

It's better to free partial loop iterations within the loop and then
the unwinding at the end can handle whole loop iterations.  I also
renamed the labels to describe what the goto does and not where the goto
was located.

Fixes: 3fd2f4bc ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs")
Reported-by: default avatarColin Ian King <colin.i.king@gmail.com>
Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/


Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarDave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent b7cb9a03

drivers/dma/idxd/init.c

+17 −16
Original line number Diff line number Diff line
@@ -189,27 +189,30 @@ static int idxd_setup_wqs(struct idxd_device *idxd) 
	idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev));

	if (!idxd->wq_enable_map) {

		rc = -ENOMEM;

		goto err_bitmap;

		goto err_free_wqs;

	}



	for (i = 0; i < idxd->max_wqs; i++) {

		wq = kzalloc_node(sizeof(*wq), GFP_KERNEL, dev_to_node(dev));

		if (!wq) {

			rc = -ENOMEM;

			goto err;

			goto err_unwind;

		}



		idxd_dev_set_type(&wq->idxd_dev, IDXD_DEV_WQ);

		conf_dev = wq_confdev(wq);

		wq->id = i;

		wq->idxd = idxd;

		device_initialize(wq_confdev(wq));

		device_initialize(conf_dev);

		conf_dev->parent = idxd_confdev(idxd);

		conf_dev->bus = &dsa_bus_type;

		conf_dev->type = &idxd_wq_device_type;

		rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id);

		if (rc < 0)

			goto err;

		if (rc < 0) {

			put_device(conf_dev);

			kfree(wq);

			goto err_unwind;

		}



		mutex_init(&wq->wq_lock);

		init_waitqueue_head(&wq->err_queue);
@@ -220,15 +223,20 @@ static int idxd_setup_wqs(struct idxd_device *idxd) 
		wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;

		wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev));

		if (!wq->wqcfg) {

			put_device(conf_dev);

			kfree(wq);

			rc = -ENOMEM;

			goto err;

			goto err_unwind;

		}



		if (idxd->hw.wq_cap.op_config) {

			wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL);

			if (!wq->opcap_bmap) {

				kfree(wq->wqcfg);

				put_device(conf_dev);

				kfree(wq);

				rc = -ENOMEM;

				goto err_opcap_bmap;

				goto err_unwind;

			}

			bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS);

		}
@@ -239,13 +247,7 @@ static int idxd_setup_wqs(struct idxd_device *idxd) 


	return 0;



err_opcap_bmap:

	kfree(wq->wqcfg);



err:

	put_device(conf_dev);

	kfree(wq);



err_unwind:

	while (--i >= 0) {

		wq = idxd->wqs[i];

		if (idxd->hw.wq_cap.op_config)
@@ -254,11 +256,10 @@ static int idxd_setup_wqs(struct idxd_device *idxd) 
		conf_dev = wq_confdev(wq);

		put_device(conf_dev);

		kfree(wq);



	}

	bitmap_free(idxd->wq_enable_map);



err_bitmap:

err_free_wqs:

	kfree(idxd->wqs);



	return rc;