[PATCH] dmaengine: idxd: Fix saved engines array leak in config save

[Guangshuo Li]

idxd_device_config_save() uses cleanup.h helpers for temporary
allocations while saving device configuration. The saved_groups and
saved_wqs pointer arrays are declared with __free(kfree), and ownership
is transferred to idxd_saved with no_free_ptr() on the success path.

The saved_engines pointer array follows the same ownership pattern on the
success path, but it is not declared with __free(kfree). As a result, if
an error happens after saved_engines is allocated, idxd_free_saved()
frees the saved engine objects but not the saved_engines array itself.

This leaks saved_engines on error paths such as:
  - failure to allocate an individual saved engine
  - failure to allocate saved_wq_enable_map
  - failure to allocate saved_wqs
  - failure to allocate an individual saved WQ

Declare saved_engines with __free(kfree) so the array is released
automatically on failure, matching saved_groups and saved_wqs. The success
path is unchanged because ownership is already transferred with
no_free_ptr().

Fixes: 6078a315aec1 ("dmaengine: idxd: Add idxd_device_config_save() and idxd_device_config_restore() helpers")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/dma/idxd/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
index f1cfc7790d95..02210f16d391 100644
--- a/drivers/dma/idxd/init.c
+++ b/drivers/dma/idxd/init.c
@@ -880,7 +880,7 @@ static int idxd_device_config_save(struct idxd_device *idxd,
 		saved_groups[i] = no_free_ptr(saved_group);
 	}
 
-	struct idxd_engine **saved_engines =
+	struct idxd_engine **saved_engines __free(kfree) =
 			kcalloc_node(idxd->max_engines,
 				     sizeof(struct idxd_engine *),
 				     GFP_KERNEL, dev_to_node(dev));
-- 
2.43.0