Commit 52adee58 authored Sep 30, 2015 by Andrew Donnellan Committed by Michael Ellerman Oct 01, 2015

cxl: fix leak of ctx->irq_bitmap when releasing context via kernel API



At present, ctx->irq_bitmap is freed in afu_release_irqs(), which is called
from afu_release() via cxl_context_detach().

Move the freeing of ctx->irq_bitmap from afu_release_irqs() to
reclaim_ctx() (called through cxl_context_free()) so it's freed when
releasing a context via the kernel API (cxl_release_context()) or the
userspace API (afu_release()).

Reported-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Fixes: 6f7f0b3d ("cxl: Add AFU virtual PHB and kernel API")
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Reviewed-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

parent 8dde152e

drivers/misc/cxl/context.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -275,6 +275,9 @@ static void reclaim_ctx(struct rcu_head *rcu)
	if (ctx->kernelapi)		if (ctx->kernelapi)
	kfree(ctx->mapping);		kfree(ctx->mapping);

			if (ctx->irq_bitmap)
			kfree(ctx->irq_bitmap);

	kfree(ctx);		kfree(ctx);
	}		}

drivers/misc/cxl/irq.c

+0 −2

Original line number	Original line	Diff line number	Diff line
	@@ -524,7 +524,5 @@ void afu_release_irqs(struct cxl_context ctx, void cookie)
	afu_irq_name_free(ctx);		afu_irq_name_free(ctx);
	cxl_release_irq_ranges(&ctx->irqs, ctx->afu->adapter);		cxl_release_irq_ranges(&ctx->irqs, ctx->afu->adapter);

	kfree(ctx->irq_bitmap);
	ctx->irq_bitmap = NULL;
	ctx->irq_count = 0;		ctx->irq_count = 0;
	}		}