* [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
@ 2026-03-12 16:40 Thorsten Blum
2026-03-12 18:59 ` Pranjal Shrivastava
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Thorsten Blum @ 2026-03-12 16:40 UTC (permalink / raw)
To: Jason Gunthorpe, Kevin Tian, Joerg Roedel, Will Deacon,
Robin Murphy, Pranjal Shrivastava, Nicolin Chen
Cc: Thorsten Blum, iommu, linux-kernel
mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
but its error path and mock_viommu_destroy() only release the first page
using free_page(), leaking the second page. Use free_pages() with the
matching order instead to avoid any page leaks.
Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
drivers/iommu/iommufd/selftest.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index 7823142097d4..83e2215e7800 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -636,7 +636,7 @@ static void mock_viommu_destroy(struct iommufd_viommu *viommu)
if (mock_viommu->mmap_offset)
iommufd_viommu_destroy_mmap(&mock_viommu->core,
mock_viommu->mmap_offset);
- free_page((unsigned long)mock_viommu->page);
+ free_pages((unsigned long)mock_viommu->page, 1);
mutex_destroy(&mock_viommu->queue_mutex);
/* iommufd core frees mock_viommu and viommu */
@@ -870,7 +870,7 @@ static int mock_viommu_init(struct iommufd_viommu *viommu,
iommufd_viommu_destroy_mmap(&mock_viommu->core,
mock_viommu->mmap_offset);
err_free_page:
- free_page((unsigned long)mock_viommu->page);
+ free_pages((unsigned long)mock_viommu->page, 1);
return rc;
}
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
2026-03-12 16:40 [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} Thorsten Blum
@ 2026-03-12 18:59 ` Pranjal Shrivastava
2026-03-12 19:56 ` Nicolin Chen
2026-03-13 16:29 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Pranjal Shrivastava @ 2026-03-12 18:59 UTC (permalink / raw)
To: Thorsten Blum
Cc: Jason Gunthorpe, Kevin Tian, Joerg Roedel, Will Deacon,
Robin Murphy, Nicolin Chen, iommu, linux-kernel
On Thu, Mar 12, 2026 at 05:40:42PM +0100, Thorsten Blum wrote:
> mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
> but its error path and mock_viommu_destroy() only release the first page
> using free_page(), leaking the second page. Use free_pages() with the
> matching order instead to avoid any page leaks.
>
> Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface")
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Thanks for the fix. We indeed allocate two pages but free only the first
one. I guess we missed that earlier.
Reviewed-by: Pranjal Shrivastava <praan@google.com>
> ---
> drivers/iommu/iommufd/selftest.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
> index 7823142097d4..83e2215e7800 100644
> --- a/drivers/iommu/iommufd/selftest.c
> +++ b/drivers/iommu/iommufd/selftest.c
> @@ -636,7 +636,7 @@ static void mock_viommu_destroy(struct iommufd_viommu *viommu)
> if (mock_viommu->mmap_offset)
> iommufd_viommu_destroy_mmap(&mock_viommu->core,
> mock_viommu->mmap_offset);
> - free_page((unsigned long)mock_viommu->page);
> + free_pages((unsigned long)mock_viommu->page, 1);
> mutex_destroy(&mock_viommu->queue_mutex);
>
> /* iommufd core frees mock_viommu and viommu */
> @@ -870,7 +870,7 @@ static int mock_viommu_init(struct iommufd_viommu *viommu,
> iommufd_viommu_destroy_mmap(&mock_viommu->core,
> mock_viommu->mmap_offset);
> err_free_page:
> - free_page((unsigned long)mock_viommu->page);
> + free_pages((unsigned long)mock_viommu->page, 1);
> return rc;
> }
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
2026-03-12 16:40 [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} Thorsten Blum
2026-03-12 18:59 ` Pranjal Shrivastava
@ 2026-03-12 19:56 ` Nicolin Chen
2026-03-13 16:29 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Nicolin Chen @ 2026-03-12 19:56 UTC (permalink / raw)
To: Thorsten Blum
Cc: Jason Gunthorpe, Kevin Tian, Joerg Roedel, Will Deacon,
Robin Murphy, Pranjal Shrivastava, iommu, linux-kernel
On Thu, Mar 12, 2026 at 05:40:42PM +0100, Thorsten Blum wrote:
> mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
> but its error path and mock_viommu_destroy() only release the first page
> using free_page(), leaking the second page. Use free_pages() with the
> matching order instead to avoid any page leaks.
>
> Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface")
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
2026-03-12 16:40 [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} Thorsten Blum
2026-03-12 18:59 ` Pranjal Shrivastava
2026-03-12 19:56 ` Nicolin Chen
@ 2026-03-13 16:29 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Jason Gunthorpe @ 2026-03-13 16:29 UTC (permalink / raw)
To: Thorsten Blum
Cc: Kevin Tian, Joerg Roedel, Will Deacon, Robin Murphy,
Pranjal Shrivastava, Nicolin Chen, iommu, linux-kernel
On Thu, Mar 12, 2026 at 05:40:42PM +0100, Thorsten Blum wrote:
> mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
> but its error path and mock_viommu_destroy() only release the first page
> using free_page(), leaking the second page. Use free_pages() with the
> matching order instead to avoid any page leaks.
>
> Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface")
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
> drivers/iommu/iommufd/selftest.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Applied, thanks
Jason
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-13 16:29 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-12 16:40 [PATCH] iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} Thorsten Blum
2026-03-12 18:59 ` Pranjal Shrivastava
2026-03-12 19:56 ` Nicolin Chen
2026-03-13 16:29 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox