[PATCH] iommu: Free fwspec with the dev_iommu object

[PATCH] iommu: Free fwspec with the dev_iommu object

[Jean-Philippe Brucker]

Kmemleak reports that iommu_fwspec is leaked during device probe
deferral. For example:

1. The first device probe allocates a dev_iommu and a fwspec, then
   returns with -EPROBE_DEFER (because the IOMMU hasn't been probed
   yet).

2. The IOMMU driver registers the IOMMU on the PCI bus, which calls
   iommu_probe_device(). However at this point the device doesn't have
   IOMMU ops associated, so add_device() fails and iommu_probe_device()
   calls dev_iommu_free(), which leaks the fwspec allocated in 1.

3. The deferred device probe allocates a new dev_iommu and fwspec,
   before calling iommu_probe_device() which succeeds this time.

Fix this leak by freeing the fwspec in dev_iommu_free().

Fixes: 72acd9df18f1 ("iommu: Move iommu_fwspec to struct dev_iommu")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
---
 drivers/iommu/iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 2b471419e26c3..54757c404866c 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -170,6 +170,7 @@ static struct dev_iommu *dev_iommu_get(struct device *dev)
 
 static void dev_iommu_free(struct device *dev)
 {
+	iommu_fwspec_free(dev);
 	kfree(dev->iommu);
 	dev->iommu = NULL;
 }
-- 
2.26.0

_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu

Re: [PATCH] iommu: Free fwspec with the dev_iommu object

[Joerg Roedel]

Hi Jean-Philippe,

On Wed, Apr 22, 2020 at 03:55:14PM +0200, Jean-Philippe Brucker wrote:
> Fix this leak by freeing the fwspec in dev_iommu_free().
> 
> Fixes: 72acd9df18f1 ("iommu: Move iommu_fwspec to struct dev_iommu")
> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
> ---
>  drivers/iommu/iommu.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index 2b471419e26c3..54757c404866c 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -170,6 +170,7 @@ static struct dev_iommu *dev_iommu_get(struct device *dev)
>  
>  static void dev_iommu_free(struct device *dev)
>  {
> +	iommu_fwspec_free(dev);
>  	kfree(dev->iommu);
>  	dev->iommu = NULL;
>  }

Sorry, but [1] is already queued.

Thanks,

	Joerg

[1] https://lore.kernel.org/r/20200402143749.40500-1-haokexin@gmail.com

_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu