Re: [PATCH] iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

[Jason Gunthorpe]

On Sat, Jul 11, 2026 at 01:51:19PM +0800, Peiyang He wrote:
> iommu_mock_device_add() first calls iommu_fwspec_init(), which on
> success allocates both dev->iommu (via dev_iommu_get()) and
> dev->iommu->fwspec. If the subsequent device_add(dev) call fails,
> the error path only calls iommu_fwspec_free(dev), which frees
> fwspec but leaves dev->iommu still allocated.
> 
> This triggers the following kmemleak report when fuzzing with Syzkaller:
> 
> Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)
> in the device_add() failure path. dev_iommu_free() frees both fwspec
> and the outer dev_iommu struct and clears dev->iommu.
> 
> Reported-by: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> Fixes: 2a918911ed3d ("iommufd: Register iommufd mock devices with fwspec")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> ---
>  drivers/iommu/iommu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied thanks

Jason