Re: [PATCH] dmaengine: ioat: fix completion pool leak on ring allocation failure

[Krzysztof Kozlowski <krzk@kernel.org>]

On 09/10/2026 06:32, Haotian Zhang wrote:
> ioat_alloc_chan_resources() allocates the channel completion writeback
> area with dma_pool_zalloc() and then allocates the descriptor ring with
> ioat_alloc_ring().  The ring allocation runs under GFP_NOWAIT and can
> fail, in which case the function returns -ENOMEM without freeing the
> completion area.  As the ring pointer stays NULL, the only teardown path,
> ioat_free_chan_resources(), bails out early and never releases it; a
> subsequent retry overwrites ioat_chan->completion, leaking the previous
> allocation permanently.  The dmaengine core does not call
> device_free_chan_resources() when device_alloc_chan_resources() fails, so
> nothing else cleans it up either.
> 
> Release the completion area with dma_pool_free() before returning from the
> ring allocation error path.
> 
> Fixes: 5cbafa65b92e ("ioat2,3: convert to a true ring buffer")
> Assisted-by: DeepSeek-V4.1-Flash
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---

So you completely ignored previous emails and discussions, right?

Best regards,
Krzysztof