Commit 0fbea680 authored by Ezequiel Garcia's avatar Ezequiel Garcia Committed by Joerg Roedel
Browse files

iommu/dma: Fix leak in non-contiguous API 



Currently, iommu_dma_alloc_noncontiguous() allocates a
struct dma_sgt_handle object to hold some state needed for
iommu_dma_free_noncontiguous().

However, the handle is neither freed nor returned explicitly by
the ->alloc_noncontiguous method, and therefore seems leaked.
This was found by code inspection, so please review carefully and test.

As a side note, it appears the struct dma_sgt_handle type is exposed
to users of the DMA-API by linux/dma-map-ops.h, but is has no users
or functions returning the type explicitly.

This may indicate it's a good idea to move the struct dma_sgt_handle type
to drivers/iommu/dma-iommu.c. The decision is left to maintainers :-)

Cc: stable@vger.kernel.org
Fixes: e817ee5f ("dma-iommu: implement ->alloc_noncontiguous")
Signed-off-by: default avatarEzequiel Garcia <ezequiel@collabora.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210723010552.50969-1-ezequiel@collabora.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent ff117646

drivers/iommu/dma-iommu.c

+1 −0
Original line number Diff line number Diff line
@@ -768,6 +768,7 @@ static void iommu_dma_free_noncontiguous(struct device *dev, size_t size, 
	__iommu_dma_unmap(dev, sgt->sgl->dma_address, size);

	__iommu_dma_free_pages(sh->pages, PAGE_ALIGN(size) >> PAGE_SHIFT);

	sg_free_table(&sh->sgt);

	kfree(sh);

}

#endif /* CONFIG_DMA_REMAP */