Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c43d46d authored by Guoqing Jiang's avatar Guoqing Jiang Committed by Greg Kroah-Hartman
Browse files

iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() 



commit 99e675d473eb8cf2deac1376a0f840222fc1adcf upstream.

After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node
unconditionally allocated"). For tear down scenario, fn is only freed
after fail to allocate ir_domain, though it also should be freed in case
dmar_enable_qi returns error.

Besides free fn, irq_domain and ir_msi_domain need to be removed as well
if intel_setup_irq_remapping fails to enable queued invalidation.

Improve the rewinding path by add out_free_ir_domain and out_free_fwnode
lables per Baolu's suggestion.

Fixes: e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated")
Suggested-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: default avatarGuoqing Jiang <guoqing.jiang@linux.dev>
Link: https://lore.kernel.org/r/20220119063640.16864-1-guoqing.jiang@linux.dev


Signed-off-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20220128031002.2219155-3-baolu.lu@linux.intel.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cff7faba

drivers/iommu/intel_irq_remapping.c

+10 −3
Original line number Diff line number Diff line
@@ -570,9 +570,8 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) 
					    fn, &intel_ir_domain_ops,

					    iommu);

	if (!iommu->ir_domain) {

		irq_domain_free_fwnode(fn);

		pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id);

		goto out_free_bitmap;

		goto out_free_fwnode;

	}

	iommu->ir_msi_domain =

		arch_create_remap_msi_irq_domain(iommu->ir_domain,
@@ -596,7 +595,7 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) 


		if (dmar_enable_qi(iommu)) {

			pr_err("Failed to enable queued invalidation\n");

			goto out_free_bitmap;

			goto out_free_ir_domain;

		}

	}
@@ -620,6 +619,14 @@ static int intel_setup_irq_remapping(struct intel_iommu *iommu) 


	return 0;



out_free_ir_domain:

	if (iommu->ir_msi_domain)

		irq_domain_remove(iommu->ir_msi_domain);

	iommu->ir_msi_domain = NULL;

	irq_domain_remove(iommu->ir_domain);

	iommu->ir_domain = NULL;

out_free_fwnode:

	irq_domain_free_fwnode(fn);

out_free_bitmap:

	bitmap_free(bitmap);

out_free_pages: