FAILED: patch "[PATCH] firmware: stratix10-svc: fix memory leaks and list corruption" failed to apply to 5.15-stable tree

FAILED: patch "[PATCH] firmware: stratix10-svc: fix memory leaks and list corruption" failed to apply to 5.15-stable tree

[gregkh]

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072955-anatomist-verdict-df3a@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c Mon Sep 17 00:00:00 2001
From: Tze Yee Ng <tze.yee.ng@altera.com>
Date: Wed, 24 Jun 2026 03:06:35 -0700
Subject: [PATCH] firmware: stratix10-svc: fix memory leaks and list corruption
 bugs

Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
explicit kfree() in the free path to match its list-managed lifetime.
Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
on failed lookups.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org # 5.0+
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index c24ca5823078..6306b79a14a1 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -1857,14 +1857,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
 	struct gen_pool *genpool = chan->ctrl->genpool;
 	size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+	pmem = kzalloc_obj(*pmem);
 	if (!pmem)
 		return ERR_PTR(-ENOMEM);
 
 	guard(mutex)(&svc_mem_lock);
 	va = gen_pool_alloc(genpool, s);
-	if (!va)
+	if (!va) {
+		kfree(pmem);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memset((void *)va, 0, s);
 	pa = gen_pool_virt_to_phys(genpool, va);
@@ -1890,6 +1892,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
 void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 {
 	struct stratix10_svc_data_mem *pmem;
+
 	guard(mutex)(&svc_mem_lock);
 
 	list_for_each_entry(pmem, &svc_data_mem, node)
@@ -1898,10 +1901,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 				       (unsigned long)kaddr, pmem->size);
 			pmem->vaddr = NULL;
 			list_del(&pmem->node);
+			kfree(pmem);
 			return;
 		}
-
-	list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
 

[PATCH 5.15.y] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[tze.yee.ng]

From: Tze Yee Ng <tze.yee.ng@altera.com>

Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
explicit kfree() in the free path to match its list-managed lifetime.
Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
on failed lookups.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org # 5.0+
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
(cherry picked from commit 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c)
---
 drivers/firmware/stratix10-svc.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 993ef210169c..ac9c6fcfe504 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -911,13 +911,15 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
 	struct gen_pool *genpool = chan->ctrl->genpool;
 	size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+	pmem = kzalloc_obj(*pmem);
 	if (!pmem)
 		return ERR_PTR(-ENOMEM);
 
 	va = gen_pool_alloc(genpool, s);
-	if (!va)
+	if (!va) {
+		kfree(pmem);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memset((void *)va, 0, s);
 	pa = gen_pool_virt_to_phys(genpool, va);
@@ -944,16 +946,17 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 {
 	struct stratix10_svc_data_mem *pmem;
 
+	guard(mutex)(&svc_mem_lock);
+
 	list_for_each_entry(pmem, &svc_data_mem, node)
 		if (pmem->vaddr == kaddr) {
 			gen_pool_free(chan->ctrl->genpool,
 				       (unsigned long)kaddr, pmem->size);
 			pmem->vaddr = NULL;
 			list_del(&pmem->node);
+			kfree(pmem);
 			return;
 		}
-
-	list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
 
-- 
2.43.7

Re: [PATCH 5.15.y] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[Sasha Levin]

On Wed, Jul 29, 2026 at 07:36:04PM -0700, tze.yee.ng@altera.com wrote:
>-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
>+	pmem = kzalloc_obj(*pmem);

Did you even build test this?

>@@ -944,16 +946,17 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
> {
> 	struct stratix10_svc_data_mem *pmem;
>
>+	guard(mutex)(&svc_mem_lock);
>+
> 	list_for_each_entry(pmem, &svc_data_mem, node)

This wouldn't work either, right?

-- 
Thanks,
Sasha

Re: [PATCH 5.15.y] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[NG, TZE YEE]

On 31/7/2026 10:39 am, Sasha Levin wrote:
> [You don't often get email from sashal@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Wed, Jul 29, 2026 at 07:36:04PM -0700, tze.yee.ng@altera.com wrote:
>> -      pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
>> +      pmem = kzalloc_obj(*pmem);
> 
> Did you even build test this?
> 
>> @@ -944,16 +946,17 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
>> {
>>        struct stratix10_svc_data_mem *pmem;
>>
>> +      guard(mutex)(&svc_mem_lock);
>> +
>>        list_for_each_entry(pmem, &svc_data_mem, node)
> 
> This wouldn't work either, right?
> 
> --
> Thanks,
> Sasha

Hi Sasha,

Thanks for the review. You are right — this backport is incorrect as 
submitted.

kzalloc_obj() is not available on these stable kernels, and the 
guard(mutex)(&svc_mem_lock) line was accidentally introduced during 
rebase; it is not part of the upstream fix and should not be in this 
backport.

The same issues are present in the 5.10.y backport as well. I will send 
a v2 patches for both 5.15.y and 5.10.y that:
   - replaces kzalloc_obj() with kzalloc(sizeof(*pmem), GFP_KERNEL)
   - drops the stray guard(mutex)(&svc_mem_lock)

Sorry for the noise.

Thanks,
Tze Yee

Re: FAILED: patch "[PATCH] firmware: stratix10-svc: fix memory leaks and list corruption" failed to apply to 5.15-stable tree

[NG, TZE YEE]

On 29/7/2026 9:28 pm, gregkh@linuxfoundation.org wrote:
>
> The patch below does not apply to the 5.15-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
>
> To reproduce the conflict and resubmit, you may use the following commands:
>
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
> git checkout FETCH_HEAD
> git cherry-pick -x 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072955-anatomist-verdict-df3a@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'
>
> Possible dependencies:
>
>
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
>  From 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c Mon Sep 17 00:00:00 2001
> From: Tze Yee Ng <tze.yee.ng@altera.com>
> Date: Wed, 24 Jun 2026 03:06:35 -0700
> Subject: [PATCH] firmware: stratix10-svc: fix memory leaks and list corruption
>   bugs
>
> Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
> path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
> explicit kfree() in the free path to match its list-managed lifetime.
> Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
> on failed lookups.
>
> Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
> Cc: stable@vger.kernel.org # 5.0+
> Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
>
> diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
> index c24ca5823078..6306b79a14a1 100644
> --- a/drivers/firmware/stratix10-svc.c
> +++ b/drivers/firmware/stratix10-svc.c
> @@ -1857,14 +1857,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
>       struct gen_pool *genpool = chan->ctrl->genpool;
>       size_t s = roundup(size, 1 << genpool->min_alloc_order);
>
> -     pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
> +     pmem = kzalloc_obj(*pmem);
>       if (!pmem)
>               return ERR_PTR(-ENOMEM);
>
>       guard(mutex)(&svc_mem_lock);
>       va = gen_pool_alloc(genpool, s);
> -     if (!va)
> +     if (!va) {
> +             kfree(pmem);
>               return ERR_PTR(-ENOMEM);
> +     }
>
>       memset((void *)va, 0, s);
>       pa = gen_pool_virt_to_phys(genpool, va);
> @@ -1890,6 +1892,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
>   void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
>   {
>       struct stratix10_svc_data_mem *pmem;
> +
>       guard(mutex)(&svc_mem_lock);
>
>       list_for_each_entry(pmem, &svc_data_mem, node)
> @@ -1898,10 +1901,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
>                                      (unsigned long)kaddr, pmem->size);
>                       pmem->vaddr = NULL;
>                       list_del(&pmem->node);
> +                     kfree(pmem);
>                       return;
>               }
> -
> -     list_del(&svc_data_mem);
>   }
>   EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
>
>

Hi Greg,

Thanks for the detailed steps. I've resolved the conflict and
resubmitted the patch.

https://lore.kernel.org/all/20260730023604.14996-1-tze.yee.ng@altera.com/

Thanks,
Regards,
Tze Yee

[PATCH 5.15.y v2] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[tze.yee.ng]

From: Tze Yee Ng <tze.yee.ng@altera.com>

Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
explicit kfree() in the free path to match its list-managed lifetime.
Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
on failed lookups.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org#5.0+
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
(cherry picked from commit 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c)
---
Changes in v2:
- Replaced kzalloc_obj() with kzalloc(sizeof(*pmem), GFP_KERNEL).
- Dropped the stray guard(mutex)(&svc_mem_lock) which is added
  accidentally when rebase.
---
 drivers/firmware/stratix10-svc.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 993ef210169c..c5ddd20fe4b7 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -911,13 +911,15 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
 	struct gen_pool *genpool = chan->ctrl->genpool;
 	size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+	pmem = kzalloc(sizeof(*pmem), GFP_KERNEL);
 	if (!pmem)
 		return ERR_PTR(-ENOMEM);
 
 	va = gen_pool_alloc(genpool, s);
-	if (!va)
+	if (!va) {
+		kfree(pmem);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memset((void *)va, 0, s);
 	pa = gen_pool_virt_to_phys(genpool, va);
@@ -950,10 +952,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 				       (unsigned long)kaddr, pmem->size);
 			pmem->vaddr = NULL;
 			list_del(&pmem->node);
+			kfree(pmem);
 			return;
 		}
-
-	list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
 
-- 
2.43.7

Re: [PATCH 5.15.y v2] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[Sasha Levin]

On Tue, Aug 04, 2026 at 04:17:00AM -0700, Tze Yee Ng wrote:
> Changes in v2:
> - Replaced kzalloc_obj() with kzalloc(sizeof(*pmem), GFP_KERNEL).
> - Dropped the stray guard(mutex)(&svc_mem_lock) which is added
>   accidentally when rebase.

This looks good, but we need it in 6.6 and 6.1 first. I haven't seen backports
for those.

-- 
Thanks,
Sasha

Re: [PATCH 5.15.y v2] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[NG, TZE YEE]

On 5/8/2026 9:13 am, Sasha Levin wrote:
> [You don't often get email from sashal@kernel.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Tue, Aug 04, 2026 at 04:17:00AM -0700, Tze Yee Ng wrote:
>> Changes in v2:
>> - Replaced kzalloc_obj() with kzalloc(sizeof(*pmem), GFP_KERNEL).
>> - Dropped the stray guard(mutex)(&svc_mem_lock) which is added
>>    accidentally when rebase.
> 
> This looks good, but we need it in 6.6 and 6.1 first. I haven't seen backports
> for those.
> 
> --
> Thanks,
> Sasha

Hi Sasha,

Thanks for review.

Hi Greg,

I see you helped to backport the patch to 5.10, 5.15, 6.12, 6.18 and 
7.1. Should I follow the same steps shared by you to submit the patch to 
6.1 and 6.6 mentioned by Sasha?

Thanks,
Tze Yee

Re: [PATCH 5.15.y v2] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[Sasha Levin]

On Wed, Aug 05, 2026 at 02:43:12AM +0000, NG, TZE YEE wrote:
> I see you helped to backport the patch to 5.10, 5.15, 6.12, 6.18 and
> 7.1. Should I follow the same steps shared by you to submit the patch to
> 6.1 and 6.6 mentioned by Sasha?

Yes please, one patch each for 6.6.y and 6.1.y, the same way you sent the
5.15.y and 5.10.y v2.

Your 5.15.y and 5.10.y v2 patches look good and stay on hold until 6.6 and
6.1 have the fix.

-- 
Thanks,
Sasha