From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-97.freemail.mail.aliyun.com (out30-97.freemail.mail.aliyun.com [115.124.30.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C72AF1E885A; Thu, 2 Apr 2026 01:32:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.97 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775093533; cv=none; b=KqmPs3ycSieCYje2PhBZWkcs7ZGbZckf/GvQW4ithqU3xaximvSu0kryl4pthsmwW7QTCvAfjM6u7uYJpBNq5cH5n+zSKZ0mWWXNlQCGeFhAxswsaYNfVIXNidCMISNcHeYBFVetbfX/ovc67hK3YLmRmOxczSolgaBtAfMAfJ8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775093533; c=relaxed/simple; bh=q31r6y+c2kh5xyneHd/KgA8RaCHvnZvFHfQdBURLmvc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=oe7cegA1acN23nNJzHMPR1Oe9syw3tW0K2duz5QSrQWdwLx9wH3BDbC6wY/dlCjSVnMXeVCWF5QbXUo0qc0qF/Mc8+8KEc7WyNYcnYBhT/N4Pp6h/8c9B90go/AIi7ztiFLYFv2K6JSBUf6nJsjGRlfO995WAz6PPopdkCFteqI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=Zar8Yl8g; arc=none smtp.client-ip=115.124.30.97 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="Zar8Yl8g" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1775093524; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=68sUhpCzBeo8yOYWdJvOus9Env4cx8x9VdhpXC2y68c=; b=Zar8Yl8g9uKo2blrqEYhvXn08M4MwWtR7wJ+y2Zd4++omkDBkdzy0VTxnL2eG0vOGo8cGfweBB1UgrmHLNS8jv9kGmL31M2VacH14O5GjCYI7yDVSOy1Am375wgaXvNlztyr/vAiUiULakCzwJRbrmDksIAhwZIkw7SmWysRIwA= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R611e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033045098064;MF=xueshuai@linux.alibaba.com;NM=1;PH=DS;RN=8;SR=0;TI=SMTPD_---0X0FQ2fv_1775093522; Received: from 30.246.177.235(mailfrom:xueshuai@linux.alibaba.com fp:SMTPD_---0X0FQ2fv_1775093522 cluster:ay36) by smtp.aliyun-inc.com; Thu, 02 Apr 2026 09:32:03 +0800 Message-ID: Date: Thu, 2 Apr 2026 09:32:14 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] dmaengine: idxd: fix double free in idxd_setup_groups() error path To: Guangshuo Li , Vinicius Costa Gomes , Dave Jiang , Vinod Koul , Fenghua Yu , dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org References: <20260401033622.1446904-1-lgs201920130244@gmail.com> From: Shuai Xue In-Reply-To: <20260401033622.1446904-1-lgs201920130244@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 4/1/26 11:36 AM, Guangshuo Li wrote: > When an error happens after device_initialize(), idxd_setup_groups() > calls put_device(conf_dev). > > The device release callback idxd_conf_group_release() frees group, but > the current error paths then call kfree(group) again, causing a double > free. > > Keep the cleanup in idxd_conf_group_release() after put_device() and > avoid freeing group again in idxd_setup_groups(). Yes, I think it is a double free. Sorry, I missed the idxd_conf_group_release path. > > Fixes: aa6f4f945b10 ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_groups") > Cc: stable@vger.kernel.org > Signed-off-by: Guangshuo Li > --- > drivers/dma/idxd/init.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c > index b782eb3c191d..d9a9d56dd277 100644 > --- a/drivers/dma/idxd/init.c > +++ b/drivers/dma/idxd/init.c > @@ -374,7 +374,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) > rc = dev_set_name(conf_dev, "group%d.%d", idxd->id, group->id); > if (rc < 0) { > put_device(conf_dev); > - kfree(group); > + > goto err; > } > > @@ -399,7 +399,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) > while (--i >= 0) { > group = idxd->groups[i]; > put_device(group_confdev(group)); > - kfree(group); > + Nit: please remove the blank lines left behind by both deletions. With those addressed: Reviewed-by: Shuai Xue Thanks. Shuai