[PATCH] crypto: qat - free dc_data with kfree() in the error path

[PATCH] crypto: qat - free dc_data with kfree() in the error path

[ZhaoJinming]

qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but
its error path releases it with devm_kfree():

	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
			       dev_to_node(dev));
	...
err:
	accel_dev->dc_data = NULL;
	kfree(obuff);
	devm_kfree(dev, dc_data);

devm_kfree() only frees memory that was allocated with devm_kmalloc() and
registered with the device resource manager.  dc_data is a plain kmalloc
allocation that was never registered, so devres_destroy() does not find it,
returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing
anything.  The dc_data structure is leaked.

Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
switched dc_data to unmanaged allocation and replaced the devm_kfree() in
qat_free_dc_data(), but missed the identical call in the error path of
qat_compression_alloc_dc_data().  That path is taken when the overflow
buffer allocation or its DMA mapping fails.

Free dc_data with kfree() here as well, matching the allocation and the
other release path.

Fixes: 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
 drivers/crypto/intel/qat/qat_common/qat_compression.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/qat/qat_common/qat_compression.c b/drivers/crypto/intel/qat/qat_common/qat_compression.c
index 8129ad0c32d8..7a5b648302a0 100644
--- a/drivers/crypto/intel/qat/qat_common/qat_compression.c
+++ b/drivers/crypto/intel/qat/qat_common/qat_compression.c
@@ -241,7 +241,7 @@ static int qat_compression_alloc_dc_data(struct adf_accel_dev *accel_dev)
 err:
 	accel_dev->dc_data = NULL;
 	kfree(obuff);
-	devm_kfree(dev, dc_data);
+	kfree(dc_data);
 	return -ENOMEM;
 }
 

---
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
change-id: 20261019-qat-dc-data-kfree-76c7e1ddc2a7

Best regards,
--  
ZhaoJinming <zhaojinming@uniontech.com>

Re: [PATCH] crypto: qat - free dc_data with kfree() in the error path

[Giovanni Cabiddu]

On Mon, Oct 19, 2026 at 01:51:32PM +0800, ZhaoJinming wrote:
> qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but
> its error path releases it with devm_kfree():
> 
> 	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
> 			       dev_to_node(dev));
> 	...
> err:
> 	accel_dev->dc_data = NULL;
> 	kfree(obuff);
> 	devm_kfree(dev, dc_data);
> 
> devm_kfree() only frees memory that was allocated with devm_kmalloc() and
> registered with the device resource manager.  dc_data is a plain kmalloc
> allocation that was never registered, so devres_destroy() does not find it,
> returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing
> anything.  The dc_data structure is leaked.
> 
> Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
> switched dc_data to unmanaged allocation and replaced the devm_kfree() in
> qat_free_dc_data(), but missed the identical call in the error path of
> qat_compression_alloc_dc_data().  That path is taken when the overflow
> buffer allocation or its DMA mapping fails.
> 
> Free dc_data with kfree() here as well, matching the allocation and the
> other release path.
> 
> Fixes: 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
> Cc: stable@vger.kernel.org
> Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

Regards,

-- 
Giovanni