[PATCH] dmaengine: ioat: fix completion pool leak on ring allocation failure

[PATCH] dmaengine: ioat: fix completion pool leak on ring allocation failure

[Haotian Zhang]

ioat_alloc_chan_resources() allocates the channel completion writeback
area with dma_pool_zalloc() and then allocates the descriptor ring with
ioat_alloc_ring().  The ring allocation runs under GFP_NOWAIT and can
fail, in which case the function returns -ENOMEM without freeing the
completion area.  As the ring pointer stays NULL, the only teardown path,
ioat_free_chan_resources(), bails out early and never releases it; a
subsequent retry overwrites ioat_chan->completion, leaking the previous
allocation permanently.  The dmaengine core does not call
device_free_chan_resources() when device_alloc_chan_resources() fails, so
nothing else cleans it up either.

Release the completion area with dma_pool_free() before returning from the
ring allocation error path.

Fixes: 5cbafa65b92e ("ioat2,3: convert to a true ring buffer")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 drivers/dma/ioat/init.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
index 737496391109..000b59f0f04e 100644
--- a/drivers/dma/ioat/init.c
+++ b/drivers/dma/ioat/init.c
@@ -695,8 +695,14 @@ static int ioat_alloc_chan_resources(struct dma_chan *c)
 
 	order = IOAT_MAX_ORDER;
 	ring = ioat_alloc_ring(c, order, GFP_NOWAIT);
-	if (!ring)
+	if (!ring) {
+		dma_pool_free(ioat_chan->ioat_dma->completion_pool,
+			      ioat_chan->completion,
+			      ioat_chan->completion_dma);
+		ioat_chan->completion = NULL;
+		ioat_chan->completion_dma = 0;
 		return -ENOMEM;
+	}
 
 	spin_lock_bh(&ioat_chan->cleanup_lock);
 	spin_lock_bh(&ioat_chan->prep_lock);
-- 
2.25.1

Re: [PATCH] dmaengine: ioat: fix completion pool leak on ring allocation failure

[Krzysztof Kozlowski]

On 09/10/2026 06:32, Haotian Zhang wrote:
> ioat_alloc_chan_resources() allocates the channel completion writeback
> area with dma_pool_zalloc() and then allocates the descriptor ring with
> ioat_alloc_ring().  The ring allocation runs under GFP_NOWAIT and can
> fail, in which case the function returns -ENOMEM without freeing the
> completion area.  As the ring pointer stays NULL, the only teardown path,
> ioat_free_chan_resources(), bails out early and never releases it; a
> subsequent retry overwrites ioat_chan->completion, leaking the previous
> allocation permanently.  The dmaengine core does not call
> device_free_chan_resources() when device_alloc_chan_resources() fails, so
> nothing else cleans it up either.
> 
> Release the completion area with dma_pool_free() before returning from the
> ring allocation error path.
> 
> Fixes: 5cbafa65b92e ("ioat2,3: convert to a true ring buffer")
> Assisted-by: DeepSeek-V4.1-Flash
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---

So you completely ignored previous emails and discussions, right?

Best regards,
Krzysztof

Re: [PATCH] dmaengine: ioat: fix completion pool leak on ring allocation failure

[Krzysztof Kozlowski]

On Fri, 09 Oct 2026 12:32:29 +0800, Haotian Zhang wrote:
> ioat_alloc_chan_resources() allocates the channel completion writeback
> area with dma_pool_zalloc() and then allocates the descriptor ring with
> ioat_alloc_ring().  The ring allocation runs under GFP_NOWAIT and can
> fail, in which case the function returns -ENOMEM without freeing the
> completion area.  As the ring pointer stays NULL, the only teardown path,
> ioat_free_chan_resources(), bails out early and never releases it; a
> subsequent retry overwrites ioat_chan->completion, leaking the previous
> allocation permanently.  The dmaengine core does not call
> device_free_chan_resources() when device_alloc_chan_resources() fails, so
> nothing else cleans it up either.
> 
> Release the completion area with dma_pool_free() before returning from the
> ring allocation error path.
> 
> Fixes: 5cbafa65b92e ("ioat2,3: convert to a true ring buffer")
> Assisted-by: DeepSeek-V4.1-Flash
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>  drivers/dma/ioat/init.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback.

2. You use multiple identities with this email, thus I actually doubt we speak
   with actual person.

3. Finally, same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document usage of LLM and how what you should not do
if this was posted in a good faith.

Best regards,
Krzysztof