dmaengine: idxd: Fix double free in idxd_setup_wqs()

The clean up in idxd_setup_wqs() has had a couple bugs because the error
handling is a bit subtle.  It's simpler to just re-write it in a cleaner
way.  The issues here are:

1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when
   "conf_dev" hasn't been initialized.
2) If kzalloc_node() fails then again "conf_dev" is invalid.  It's
   either uninitialized or it points to the "conf_dev" from the
   previous iteration so it leads to a double free.

It's better to free partial loop iterations within the loop and then
the unwinding at the end can handle whole loop iterations.  I also
renamed the labels to describe what the goto does and not where the goto
was located.

Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs")
Reported-by: Colin Ian King <colin.i.king@gmail.com>
Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>

diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index efe614a528faf3656dde19735c2166a52138f6f7..8c4725ad1f648dd22124e2ef6e9b9e7bd2504b34 100644 (file)
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -189,27 +189,30 @@ static int idxd_setup_wqs(struct idxd_device *idxd)
        idxd->wq_enable_map = bitmap_zalloc_node(idxd->max_wqs, GFP_KERNEL, dev_to_node(dev));
        if (!idxd->wq_enable_map) {
                rc = -ENOMEM;
-               goto err_bitmap;
+               goto err_free_wqs;
        }
 
        for (i = 0; i < idxd->max_wqs; i++) {
                wq = kzalloc_node(sizeof(*wq), GFP_KERNEL, dev_to_node(dev));
                if (!wq) {
                        rc = -ENOMEM;
-                       goto err;
+                       goto err_unwind;
                }
 
                idxd_dev_set_type(&wq->idxd_dev, IDXD_DEV_WQ);
                conf_dev = wq_confdev(wq);
                wq->id = i;
                wq->idxd = idxd;
-               device_initialize(wq_confdev(wq));
+               device_initialize(conf_dev);
                conf_dev->parent = idxd_confdev(idxd);
                conf_dev->bus = &dsa_bus_type;
                conf_dev->type = &idxd_wq_device_type;
                rc = dev_set_name(conf_dev, "wq%d.%d", idxd->id, wq->id);
-               if (rc < 0)
-                       goto err;
+               if (rc < 0) {
+                       put_device(conf_dev);
+                       kfree(wq);
+                       goto err_unwind;
+               }
 
                mutex_init(&wq->wq_lock);
                init_waitqueue_head(&wq->err_queue);
@@ -220,15 +223,20 @@ static int idxd_setup_wqs(struct idxd_device *idxd)
                wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES;
                wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev));
                if (!wq->wqcfg) {
+                       put_device(conf_dev);
+                       kfree(wq);
                        rc = -ENOMEM;
-                       goto err;
+                       goto err_unwind;
                }
 
                if (idxd->hw.wq_cap.op_config) {
                        wq->opcap_bmap = bitmap_zalloc(IDXD_MAX_OPCAP_BITS, GFP_KERNEL);
                        if (!wq->opcap_bmap) {
+                               kfree(wq->wqcfg);
+                               put_device(conf_dev);
+                               kfree(wq);
                                rc = -ENOMEM;
-                               goto err_opcap_bmap;
+                               goto err_unwind;
                        }
                        bitmap_copy(wq->opcap_bmap, idxd->opcap_bmap, IDXD_MAX_OPCAP_BITS);
                }
@@ -239,13 +247,7 @@ static int idxd_setup_wqs(struct idxd_device *idxd)
 
        return 0;
 
-err_opcap_bmap:
-       kfree(wq->wqcfg);
-
-err:
-       put_device(conf_dev);
-       kfree(wq);
-
+err_unwind:
        while (--i >= 0) {
                wq = idxd->wqs[i];
                if (idxd->hw.wq_cap.op_config)
@@ -254,11 +256,10 @@ err:
                conf_dev = wq_confdev(wq);
                put_device(conf_dev);
                kfree(wq);
-
        }
        bitmap_free(idxd->wq_enable_map);
 
-err_bitmap:
+err_free_wqs:
        kfree(idxd->wqs);
 
        return rc;