Commit 8fe8a092 authored by Akhilesh Patil's avatar Akhilesh Patil Committed by Jason Gunthorpe
Browse files

iommufd: viommu: free memory allocated by kvcalloc() using kvfree() 

Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
Ensure the memory is properly freed, as kvcalloc may internally use
vmalloc or kmalloc depending on available memory in the system.

Fixes: 2238ddc2 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
Link: https://patch.msgid.link/r/aJifyVV2PL6WGEs6@bhairav-test.ee.iitb.ac.in


Signed-off-by: default avatarAkhilesh Patil <akhilesh@ee.iitb.ac.in>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reviewed-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Reviewed-by: default avatarPranjal Shrivastava <praan@google.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent c17b750b

drivers/iommu/iommufd/viommu.c

+2 −2
Original line number Diff line number Diff line
@@ -339,7 +339,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd, 
	}



	*base_pa = (page_to_pfn(pages[0]) << PAGE_SHIFT) + offset;

	kfree(pages);

	kvfree(pages);

	return access;



out_unpin:
@@ -349,7 +349,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd, 
out_destroy:

	iommufd_access_destroy_internal(viommu->ictx, access);

out_free:

	kfree(pages);

	kvfree(pages);

	return ERR_PTR(rc);

}