Re: [PATCH 1/2] accel/amdxdna: fix memory leak in amdxdna_iommu_alloc() when iommu_map() fails

[Lizhi Hou <lizhi.hou@amd.com>]

Hi Jackie,

Thanks for providing the patch. This is a known bug and the fix is on 
the way.

https://gitlab.freedesktop.org/drm/misc/kernel/-/commit/432fafdc9a3122a7bee5b2bfd23dcf2dc262a3d7

Lizhi

On 6/2/26 18:35, Jackie Liu wrote:
> From: Jackie Liu <liuyun01@kylinos.cn>
>
> When iommu_map() fails in amdxdna_iommu_alloc(), the code jumps to
> the 'free_iova' label which only frees the IOVA allocation. The
> physical pages allocated by __get_free_pages() are not freed, causing
> a memory leak.
>
> Add a 'free_pages' intermediate label to properly release the pages
> before freeing the IOVA, matching the cleanup order in
> amdxdna_iommu_free().
>
> Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> ---
>   drivers/accel/amdxdna/amdxdna_iommu.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_iommu.c b/drivers/accel/amdxdna/amdxdna_iommu.c
> index 4626434d4180..af67e059d599 100644
> --- a/drivers/accel/amdxdna/amdxdna_iommu.c
> +++ b/drivers/accel/amdxdna/amdxdna_iommu.c
> @@ -110,10 +110,12 @@ void *amdxdna_iommu_alloc(struct amdxdna_dev *xdna, size_t size, dma_addr_t *dma
>   			iova_align(&xdna->iovad, size),
>   			IOMMU_READ | IOMMU_WRITE, GFP_KERNEL);
>   	if (ret)
> -		goto free_iova;
> +		goto free_pages;
>   
>   	return cpu_addr;
>   
> +free_pages:
> +	free_pages((unsigned long)cpu_addr, get_order(size));
>   free_iova:
>   	__free_iova(&xdna->iovad, iova);
>   	return ERR_PTR(ret);