2024-04-25 10:18:52

by Kun(llfl)

Subject: [PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

Fix the memory leak issue that occurs when resource allocation fails in
alloc_pci_segment(). The dev_table, alias_table, and rlookup_table were
introduced individually in three commits. But they all fail to release
allocated resources when other allocations fail.

Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table"),
Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table").
Reported-by: Xuchun Shang <[email protected]>
Signed-off-by: Kun(llfl) <[email protected]>
---
drivers/iommu/amd/init.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index ac6754a85f35..4ce567f39473 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -1642,13 +1642,22 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
list_add_tail(&pci_seg->list, &amd_iommu_pci_seg_list);

if (alloc_dev_table(pci_seg))
- return NULL;
+ goto alloc_dev_fail;
if (alloc_alias_table(pci_seg))
- return NULL;
+ goto alloc_alias_fail;
if (alloc_rlookup_table(pci_seg))
- return NULL;
+ goto alloc_rlookup_fail;

return pci_seg;
+
+alloc_rlookup_fail:
+ free_rlookup_table(pci_seg);
+alloc_alias_fail:
+ free_alias_table(pci_seg);
+alloc_dev_fail:
+ free_dev_table(pci_seg);
+ kfree(pci_seg);
+ return NULL;
}

static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,
--
2.43.0

2024-04-25 10:53:26

by Robin Murphy

Subject: Re: [PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

On 25/04/2024 11:17 am, Kun(llfl) wrote:
> Fix the memory leak issue that occurs when resource allocation fails in
> alloc_pci_segment(). The dev_table, alias_table, and rlookup_table were
> introduced individually in three commits. But they all fail to release
> allocated resources when other allocations fail.

As far as I can tell the returned error should end up being handled in
state_next(), which *will* then clean these up again, at least in the
!irq_remapping_enabled path. If there's any cleanup missing from the
other path, then I think it should be fixed there, since it may well
represent more than just these particular allocations.

Thanks,
Robin.

> Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
> Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table"),
> Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table").
> Reported-by: Xuchun Shang <[email protected]>
> Signed-off-by: Kun(llfl) <[email protected]>
> ---
> drivers/iommu/amd/init.c | 15 ++++++++++++---
> 1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index ac6754a85f35..4ce567f39473 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -1642,13 +1642,22 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
> list_add_tail(&pci_seg->list, &amd_iommu_pci_seg_list);
>
> if (alloc_dev_table(pci_seg))
> - return NULL;
> + goto alloc_dev_fail;
> if (alloc_alias_table(pci_seg))
> - return NULL;
> + goto alloc_alias_fail;
> if (alloc_rlookup_table(pci_seg))
> - return NULL;
> + goto alloc_rlookup_fail;
>
> return pci_seg;
> +
> +alloc_rlookup_fail:
> + free_rlookup_table(pci_seg);
> +alloc_alias_fail:
> + free_alias_table(pci_seg);
> +alloc_dev_fail:
> + free_dev_table(pci_seg);
> + kfree(pci_seg);
> + return NULL;
> }
>
> static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,