[PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

[PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

[Kun(llfl)]

Fix the memory leak issue that occurs when resource allocation fails in
alloc_pci_segment(). The dev_table, alias_table, and rlookup_table were
introduced individually in three commits. But they all fail to release
allocated resources when other allocations fail.

Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table"),
Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table").
Reported-by: Xuchun Shang <xuchun.shang@linux.alibaba.com>
Signed-off-by: Kun(llfl) <llfl@linux.alibaba.com>
---
 drivers/iommu/amd/init.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index ac6754a85f35..4ce567f39473 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -1642,13 +1642,22 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
 	list_add_tail(&pci_seg->list, &amd_iommu_pci_seg_list);
 
 	if (alloc_dev_table(pci_seg))
-		return NULL;
+		goto alloc_dev_fail;
 	if (alloc_alias_table(pci_seg))
-		return NULL;
+		goto alloc_alias_fail;
 	if (alloc_rlookup_table(pci_seg))
-		return NULL;
+		goto alloc_rlookup_fail;
 
 	return pci_seg;
+
+alloc_rlookup_fail:
+	free_rlookup_table(pci_seg);
+alloc_alias_fail:
+	free_alias_table(pci_seg);
+alloc_dev_fail:
+	free_dev_table(pci_seg);
+	kfree(pci_seg);
+	return NULL;
 }
 
 static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,
-- 
2.43.0

Re: [PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

[Robin Murphy]

On 25/04/2024 11:17 am, Kun(llfl) wrote:
> Fix the memory leak issue that occurs when resource allocation fails in
> alloc_pci_segment(). The dev_table, alias_table, and rlookup_table were
> introduced individually in three commits. But they all fail to release
> allocated resources when other allocations fail.

As far as I can tell the returned error should end up being handled in 
state_next(), which *will* then clean these up again, at least in the 
!irq_remapping_enabled path. If there's any cleanup missing from the 
other path, then I think it should be fixed there, since it may well 
represent more than just these particular allocations.

Thanks,
Robin.

> Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
> Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table"),
> Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table").
> Reported-by: Xuchun Shang <xuchun.shang@linux.alibaba.com>
> Signed-off-by: Kun(llfl) <llfl@linux.alibaba.com>
> ---
>   drivers/iommu/amd/init.c | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index ac6754a85f35..4ce567f39473 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -1642,13 +1642,22 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
>   	list_add_tail(&pci_seg->list, &amd_iommu_pci_seg_list);
>   
>   	if (alloc_dev_table(pci_seg))
> -		return NULL;
> +		goto alloc_dev_fail;
>   	if (alloc_alias_table(pci_seg))
> -		return NULL;
> +		goto alloc_alias_fail;
>   	if (alloc_rlookup_table(pci_seg))
> -		return NULL;
> +		goto alloc_rlookup_fail;
>   
>   	return pci_seg;
> +
> +alloc_rlookup_fail:
> +	free_rlookup_table(pci_seg);
> +alloc_alias_fail:
> +	free_alias_table(pci_seg);
> +alloc_dev_fail:
> +	free_dev_table(pci_seg);
> +	kfree(pci_seg);
> +	return NULL;
>   }
>   
>   static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,