From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80CDF37B41F for ; Fri, 12 Jun 2026 07:55:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781250956; cv=none; b=SkuS4DiSq2pjUejc+pzxxDstB/jMRcGOuIW2IdkA/4YXI31wfra7DvCT/QnToE89xX/DPsbHKU5mkx7IKtwolCTcLvZZCFfHfBu2+hkOliGzTFkhheYvbavRbNsa9sZODuQWy2OmP9c2/OBbGKFP4ey7qnqbXC4etm8VUeYgQDE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781250956; c=relaxed/simple; bh=IYHpWZjxxfJrEb9MZlZed1D7bE1IARsY8nT3wM/o0qY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ulxzdaxjI7h254cOptgidJv4tze7CtUj5c/9FF+UqYu4YF5ZqgEmg9pUoU1vRYRXR5/8Yr2qtHYMwSNIj7c+l8uvfB/z5/r0XiuxhZ90Txmyi4PhEH+mIkA6hYjXxqNGIS8yDisE3ro+Ks8TfG6ngM0QLl1pO5HuwgGrd4/pQnE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MG9C1Qdq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MG9C1Qdq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 834F41F000E9; Fri, 12 Jun 2026 07:55:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781250955; bh=ogvDxile/ldnqWse2IpmfUFNHeo8D1vF0CF/rEMRMIY=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=MG9C1QdqfIZ0WxOO5YhqPhKAXb8LL9pKx2dGuIyRNvsZ04JRh0R1CTIkKSkUl1jEb xAcYrLiQOp70lw0vYh+Cd4grirMq9k4kPYXJrDCEJiNY6VGhNQcyKS/hdfK8zmf6g6 Cm3Eo8O8D+R61xWTgnaDZciSSylHDUysU7EhQoQA= Date: Fri, 12 Jun 2026 09:54:54 +0200 From: Greg Kroah-Hartman To: "NG, TZE YEE" Cc: Dinh Nguyen , Alan Tull , Richard Gong , "linux-kernel@vger.kernel.org" , "NG, ADRIAN HO YIN" , "Nazle Asmade, Muhammad Nazim Amirul" Subject: Re: [PATCH] firmware: stratix10-svc: fix memory leaks and list corruption bugs Message-ID: <2026061226-carol-john-9e12@gregkh> References: <6e13c57d085f61fc97c90ab5121b6dcc5119e035.1780996415.git.tze.yee.ng@altera.com> <2026060950-blooming-scalping-0bdc@gregkh> <0603b48f-b96b-4cc8-b51d-b9a9515c6790@altera.com> <2026061051-seismic-lyricism-7b77@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Fri, Jun 12, 2026 at 03:43:44AM +0000, NG, TZE YEE wrote: > On 10/6/2026 2:07 pm, Greg Kroah-Hartman wrote: > > On Wed, Jun 10, 2026 at 01:47:44AM +0000, NG, TZE YEE wrote: > >> On 9/6/2026 6:13 pm, Greg Kroah-Hartman wrote: > >>> [Some people who received this message don't often get email from gregkh@linuxfoundation.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > >>> > >>> On Tue, Jun 09, 2026 at 02:19:44AM -0700, tze.yee.ng@altera.com wrote: > >>>> From: Tze Yee Ng > >>>> > >>>> Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error > >>>> path. Switch pmem allocation from devm_kzalloc() to kzalloc() with > >>>> explicit kfree() in the free path to match its list-managed life time. > >>>> Remove the erroneous list_del(&svc_data_mem) which corrupted the list head > >>>> on failed lookups. Add NULL guards instratix10_svc_free_memory(). > >>>> > >>>> Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") > >>>> > >>>> Signed-off-by: Tze Yee Ng > >>>> --- > >>>> drivers/firmware/stratix10-svc.c | 12 ++++++++---- > >>>> 1 file changed, 8 insertions(+), 4 deletions(-) > >>>> > >>>> diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c > >>>> index 1ef65bf845fc..3b0e2b14180f 100644 > >>>> --- a/drivers/firmware/stratix10-svc.c > >>>> +++ b/drivers/firmware/stratix10-svc.c > >>>> @@ -1912,14 +1912,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan, > >>>> struct gen_pool *genpool = chan->ctrl->genpool; > >>>> size_t s = roundup(size, 1 << genpool->min_alloc_order); > >>>> > >>>> - pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL); > >>>> + pmem = kzalloc_obj(*pmem); > >>>> if (!pmem) > >>>> return ERR_PTR(-ENOMEM); > >>>> > >>>> guard(mutex)(&svc_mem_lock); > >>>> va = gen_pool_alloc(genpool, s); > >>>> - if (!va) > >>>> + if (!va) { > >>>> + kfree(pmem); > >>>> return ERR_PTR(-ENOMEM); > >>>> + } > >>>> > >>>> memset((void *)va, 0, s); > >>>> pa = gen_pool_virt_to_phys(genpool, va); > >>>> @@ -1945,6 +1947,9 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory); > >>>> void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr) > >>>> { > >>>> struct stratix10_svc_data_mem *pmem; > >>>> + > >>>> + if (!chan || !kaddr) > >>>> + return; > >>> > >>> What if one is not NULL but the other is? Will you not leak memory here > >>> now? > >>> > >>> thanks, > >>> > >>> greg k-h > >> Hi Greg, > >> > >> Good catch on the asymmetric case. The guard is not meant to support > >> callers passing one NULL and one non-NULL argument. > >> > >> kaddr == NULL: no-op, nothing to free. The guard prevents the old bug > >> where a failed lookup fell through to list_del(&svc_data_mem) and > >> corrupted the list head. > >> > >> chan == NULL with valid kaddr: would leak, but that is invalid API > >> usage. The previous code would oops on chan->ctrl->genpool instead of > >> freeing. In-tree callers always pass both valid pointers from > >> stratix10_svc_allocate_memory(). > >> > >> If you prefer not to silently swallow misuse, I can change this to > >> WARN_ON_ONCE(!chan || !kaddr) before returning, or drop the !chan check > >> and only guard !kaddr so a NULL channel still faults on dereference per > >> normal kernel API expectations. > > > > WARN_ON() will panic a box if it ever triggers, loosing all data, so > > please do not do that. If this is something that can happen, handle it > > properly, don't just crash. > > > > thanks, > > > > greg k-h > > Hi Greg, > > Thanks for the review. > > I went through the code again. There are already checks for both kaddr > and chan to guard against invalid API use. The !chan check is mainly a > failsafe in case a caller misuses the API. > > Regarding WARN_ON(), thanks for catching that — I had added it to flag > the !chan case. Would it be acceptable if I split the checks into two > conditions and only warn on !chan? > > if (!chan) { > WARN_ON_ONCE(!chan); again, never add new WARN_ON calls for something that can actually happen. If it can never happen, there is no need to check for it. thanks, greg k-h