[PATCH v3] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[PATCH v3] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[tze.yee.ng]

From: Tze Yee Ng <tze.yee.ng@altera.com>

Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
explicit kfree() in the free path to match its list-managed lifetime.
Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
on failed lookups.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org # 5.0+
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
---
Changes in v3:
- Remove blank line before Signed-off-by.
- No code changes.

Changes in v2:
- Remove if (!chan || !kaddr) early return from stratix10_svc_free_memory()
  per review; failed lookup is handled by dropping list_del(&svc_data_mem).
- Add Cc: stable@vger.kernel.org # 5.0+.
- Minor commit message cleanup (lifetime spelling, subject line).
---
 drivers/firmware/stratix10-svc.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 00e134e663c8..ccf57dfd9a2d 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -1848,14 +1848,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
 	struct gen_pool *genpool = chan->ctrl->genpool;
 	size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+	pmem = kzalloc_obj(*pmem);
 	if (!pmem)
 		return ERR_PTR(-ENOMEM);
 
 	guard(mutex)(&svc_mem_lock);
 	va = gen_pool_alloc(genpool, s);
-	if (!va)
+	if (!va) {
+		kfree(pmem);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memset((void *)va, 0, s);
 	pa = gen_pool_virt_to_phys(genpool, va);
@@ -1881,6 +1883,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
 void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 {
 	struct stratix10_svc_data_mem *pmem;
+
 	guard(mutex)(&svc_mem_lock);
 
 	list_for_each_entry(pmem, &svc_data_mem, node)
@@ -1889,10 +1892,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 				       (unsigned long)kaddr, pmem->size);
 			pmem->vaddr = NULL;
 			list_del(&pmem->node);
+			kfree(pmem);
 			return;
 		}
-
-	list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
 
-- 
2.43.7

Re: [PATCH v3] firmware: stratix10-svc: fix memory leaks and list corruption bugs

[Dinh Nguyen]

On 6/24/26 05:06, tze.yee.ng@altera.com wrote:
> From: Tze Yee Ng <tze.yee.ng@altera.com>
> 
> Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
> path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
> explicit kfree() in the free path to match its list-managed lifetime.
> Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
> on failed lookups.
> 
> Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
> Cc: stable@vger.kernel.org # 5.0+
> Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
> ---
> Changes in v3:
> - Remove blank line before Signed-off-by.
> - No code changes.
> 
> Changes in v2:
> - Remove if (!chan || !kaddr) early return from stratix10_svc_free_memory()
>    per review; failed lookup is handled by dropping list_del(&svc_data_mem).
> - Add Cc: stable@vger.kernel.org # 5.0+.
> - Minor commit message cleanup (lifetime spelling, subject line).
> ---
>   drivers/firmware/stratix10-svc.c | 10 ++++++----
>   1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
> index 00e134e663c8..ccf57dfd9a2d 100644
> --- a/drivers/firmware/stratix10-svc.c
> +++ b/drivers/firmware/stratix10-svc.c

Applied!

Thanks,
Dinh